{"id":"EUVD-2026-101804","enisaUuid":"f3b1685e-a51a-3320-940e-43b5a9c7009f","description":"ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated by a /api/v1/@apostrophecms/page?all\u003d1 call.","datePublished":"Oct 15, 2026, 1:15:08 AM","dateUpdated":"Oct 15, 2026, 1:24:32 PM","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-2j32-q6rx-h844\n","aliases":"CVE-2026-110904\nGHSA-cc97-9f5x-6rpj\n","assigner":"mitre","epss":0.3,"enisaIdProduct":[{"id":"a39f8d45-4008-3b37-a81e-a66881a7cf28","product":{"name":"ApostropheCMS","vendor":{"name":"apostrophecms"}},"product_version":"0 \u003c4.33.0"}],"enisaIdVendor":[{"id":"d3d32c75-0364-38d6-9b8a-f0e70c91eb34","vendor":{"name":"apostrophecms"}}],"enisaIdVulnerability":[{"id":"a283165f-4265-37dc-b789-5f9b9beed707","vulnerability":{"id":"CVE-2026-110904","description":"ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated by a /api/v1/@apostrophecms/page?all\u003d1 call.","datePublished":"Oct 15, 2026, 1:15:08 AM","dateUpdated":"Oct 15, 2026, 1:24:32 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-2j32-q6rx-h844\n","enisa_id":"EUVD-2026-101804\n","assigner":"mitre","epss":0.3,"dataProcessed":"Oct 27, 2026, 7:14:16 AM","vulnerabilityProduct":[{"id":"520ff80d-53ca-32b2-9a35-3182d932335b","product":{"name":"ApostropheCMS","vendor":{"name":"apostrophecms"}},"product_version":"0 \u003c4.33.0"}],"vulnerabilityVendor":[{"id":"cf3aca01-a63b-35b6-8e02-59fd98ec4ce5","vendor":{"name":"apostrophecms"}}]}},{"id":"a6594372-8ef4-3b66-92ba-abb11dd992d8","vulnerability":{"id":"GHSA-cc97-9f5x-6rpj","description":"ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated by a /api/v1/@apostrophecms/page?all\u003d1 call.","datePublished":"Oct 15, 2026, 3:36:26 AM","dateUpdated":"Oct 15, 2026, 3:36:26 AM","baseScore":0.0,"references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-2j32-q6rx-h844\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-110904\n","enisa_id":"EUVD-2026-101804\n","aliases":"CVE-2026-110904\nGHSA-cc97-9f5x-6rpj\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:03:05 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}