TI-2026-26246 Aliases CVE-2026-33888 GHSA-xhq9-58fw-859p

ApostropheCMS: publicApiProjection Bypass via `project` Query Builder in Piece-Type REST API

MEDIUM 63CWE-200Published 2026-04-15 · Updated 2026-04-15

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure, Security bypass
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200 and CWE-863.

Summary

ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain an authorization bypass vulnerability in the getRestQuery method of the @apostrophecms/piece-type module, where the method checks whether a MongoDB projection has already been set before applying the admin-configured publicApiProjection. An unauthenticated attacker can supply a project query parameter in the REST API request, which is processed by applyBuildersSafely before the permission check, pre-populating the projection state and causing the publicApiProjection to be skipped entirely. This allows disclosure of any field on publicly queryable documents that the administrator explicitly restricted from the public API, such as internal notes, draft content, or metadata. Exploitation is trivial, requiring only appending query parameters to a public URL with no authentication. This issue has been fixed in version 4.29.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00512 43rd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed apostrophe (apostrophecms): 4.29.0apostrophe (npm): 4.29.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
apostrophecms	apostrophe	before 4.29.0	4.29.0	Patch available	CNA
—	apostrophe (npm)	before 4.29.0	4.29.0	Patch available	GHSA-xhq9-58fw-859p

apostrophe Vendorapostrophecms Affected before 4.29.0 Fixed in 4.29.0 Patch available CNA
apostrophe (npm) Vendor— Affected before 4.29.0 Fixed in 4.29.0 Patch available GHSA-xhq9-58fw-859p

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:apostrophecms:apostrophecms::::::::	before 4.29.0	Vulnerable	apostrophecms

cpe:2.3:a:apostrophecms:apostrophecms:*:*:*:*:*:*:*:* Versions before 4.29.0 Vulnerable ·apostrophecms

Remediation

Fix · CNA apostrophe (apostrophecms) Fixed in 4.29.0
Fix · GHSA-xhq9-58fw-859p apostrophe (npm) Fixed in 4.29.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-33888
2026-10-03 Alias added: GHSA-xhq9-58fw-859p

References

Exploit 1

https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-xhq9-58fw-859p

Patch 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-33888

Other 1

https://github.com/apostrophecms/apostrophe

TI-2026-27673 ApostropheCMS: Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS CVSS 3.1HIGH 8.7
TI-2026-25222 ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware CVSS 3.1HIGH 8.1
TI-2026-28738 Information Disclosure via `choices`/`counts` Query Parameters Bypassing publicApiProjection Field Restrictions CVSS 3.1MEDIUM 5.3
TI-2026-29000 ApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements CVSS 3.1MEDIUM 6.1
TI-2026-26247 ApostropheCMS: Stored XSS via CSS Custom Property Injection in `@apostrophecms/color-field` Escaping Style Tag Context CVSS 3.1MEDIUM 5.4
TI-2026-26237 ApostropheCMS: User Enumeration via Timing Side Channel in Password Reset Endpoint CVSS 3.1LOW 3.7

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences