Read the docs
TI-2026-76957 Aliases CVE-2026-112957GHSA-vh56-5m88-39rq

ApostropheCMS page API exposes admin-only pages to editors

Priority LOW 20CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-862.

Summary

ApostropheCMS before 4.34.0 has a missing authorization flaw (CWE-862) in the getOne REST endpoint for pages. The endpoint does not apply the viewRole or viewPermission checks that the getAll endpoint enforces. An editor-level user who knows a document _id can read the full content of admin-only pages and their privileged fields.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the getOne REST endpoint for pages does not apply viewRole type-level restrictions or viewPermission field-level redaction. An editor-level user who knows a document _id can read the full content of admin-only pages and their privileged fields, while the getAll endpoint correctly enforces both restrictions. This issue is fixed in version 4.34.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00307 23rd percentileScored 2026-11-07
Fix Fixed apostrophe (apostrophecms): 4.34.0apostrophe (npm): 4.34.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
apostrophecmsapostrophebefore 4.34.04.34.0Patch availableCNA
—apostrophe (npm)before 4.34.04.34.0Patch availableGHSA-vh56-5m88-39rq
  • apostrophe Vendorapostrophecms Affected before 4.34.0 Fixed in 4.34.0 Patch available CNA
  • apostrophe (npm) Vendor— Affected before 4.34.0 Fixed in 4.34.0 Patch available GHSA-vh56-5m88-39rq

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:apostrophecms:apostrophecms:*:*:*:*:*:*:*:*——apostrophecms
  • cpe:2.3:a:apostrophecms:apostrophecms:*:*:*:*:*:*:*:* Versions — — ·apostrophecms

Remediation

Upgrade the apostrophe npm package to version 4.34.0 or later, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA apostrophe (apostrophecms) Fixed in 4.34.0
  • Fix · GHSA-vh56-5m88-39rq apostrophe (npm) Fixed in 4.34.0 Advisory →

Timeline

  1. 2026-10-20 Threatist record created from CVE-2026-112957
  2. 2026-10-21 CISA SSVC decision points changed
  3. 2026-10-21 Alias added: GHSA-vh56-5m88-39rq
  4. 2026-10-21 Fix available: npm/[email protected] · GHSA-vh56-5m88-39rq
  5. 2026-10-21 CVSS score added · GHSA-vh56-5m88-39rq
  6. 2026-10-21 Weakness changed · GHSA-vh56-5m88-39rq
  7. 2026-10-21 6 new references · GHSA-vh56-5m88-39rq

References

Advisory 1

Other 5

  • TI-2026-25223 ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction CVSS 3.1CRITICAL 10.0
  • TI-2026-32848 Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html` CVSS 3.1CRITICAL 9.3
  • TI-2026-38664 @apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag CVSS 3.1HIGH 8.7
  • TI-2026-27673 ApostropheCMS: Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS CVSS 3.1HIGH 8.7
  • TI-2026-76992 Unauthenticated resource exhaustion via ApostropheCMS import routes CVSS 3.1HIGH 7.5
  • TI-2026-76974 ApostropheCMS leaves rejected CSV uploads in temporary directory CVSS 3.1HIGH 7.5
See all 65 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences