Read the docs
TI-2026-28738 Aliases CVE-2026-39857GHSA-c276-fj82-f2pq

Information Disclosure via `choices`/`counts` Query Parameters Bypassing publicApiProjection Field Restrictions

Priority MEDIUM 63CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain an authorization bypass vulnerability in the choices and counts query parameters of the REST API, where these query builders execute MongoDB distinct() operations that bypass the publicApiProjection restrictions intended to limit which fields are exposed publicly. The choices and counts parameters are processed via applyBuildersSafely before the projection is applied, and MongoDB's distinct operation does not respect projections, returning all distinct values directly. The results are returned in the API response without any filtering against publicApiProjection or removeForbiddenFields. An unauthenticated attacker can extract all distinct field values for any schema field type that has a registered query builder, including string, integer, float, select, boolean, date, slug, and relationship fields. Fields protected with viewPermission are similarly exposed, and the counts variant additionally reveals how many documents have each distinct value. Both the piece-type and page REST APIs are affected. This issue has been fixed in version 4.29.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00435 38th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed apostrophe (apostrophecms): 4.29.0apostrophe (npm): 4.29.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
apostrophecmsapostrophebefore 4.29.04.29.0Patch availableCNA
—apostrophe (npm)before 4.29.04.29.0Patch availableGHSA-c276-fj82-f2pq
  • apostrophe Vendorapostrophecms Affected before 4.29.0 Fixed in 4.29.0 Patch available CNA
  • apostrophe (npm) Vendor— Affected before 4.29.0 Fixed in 4.29.0 Patch available GHSA-c276-fj82-f2pq

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apostrophecms:apostrophecms:*:*:*:*:*:*:*:*before 4.29.0Vulnerableapostrophecms
  • cpe:2.3:a:apostrophecms:apostrophecms:*:*:*:*:*:*:*:* Versions before 4.29.0 Vulnerable ·apostrophecms

Remediation

  • Fix · CNA apostrophe (apostrophecms) Fixed in 4.29.0
  • Fix · GHSA-c276-fj82-f2pq apostrophe (npm) Fixed in 4.29.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-39857
  2. 2026-10-03 Alias added: GHSA-c276-fj82-f2pq

References

Exploit 1

Patch 1

Advisory 1

Other 1

  • TI-2026-27673 ApostropheCMS: Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS CVSS 3.1HIGH 8.7
  • TI-2026-25222 ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware CVSS 3.1HIGH 8.1
  • TI-2026-26246 ApostropheCMS: publicApiProjection Bypass via `project` Query Builder in Piece-Type REST API CVSS 3.1MEDIUM 5.3
  • TI-2026-29000 ApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements CVSS 3.1MEDIUM 6.1
  • TI-2026-26247 ApostropheCMS: Stored XSS via CSS Custom Property Injection in `@apostrophecms/color-field` Escaping Style Tag Context CVSS 3.1MEDIUM 5.4
  • TI-2026-26237 ApostropheCMS: User Enumeration via Timing Side Channel in Password Reset Endpoint CVSS 3.1LOW 3.7
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences