{"id":"EUVD-2026-105170","enisaUuid":"d8bd89bc-a67d-33dd-b360-390e6440a18e","description":"ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the getOne REST endpoint for pages does not apply viewRole type-level restrictions or viewPermission field-level redaction. An editor-level user who knows a document _id can read the full content of admin-only pages and their privileged fields, while the getAll endpoint correctly enforces both restrictions. This issue is fixed in version 4.34.0.","datePublished":"Oct 20, 2026, 4:02:17 PM","dateUpdated":"Oct 21, 2026, 3:53:52 PM","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vh56-5m88-39rq\nhttps://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498\nhttps://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea\nhttps://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.34.0\n","aliases":"CVE-2026-112957\nGHSA-vh56-5m88-39rq\n","assigner":"GitHub_M","epss":0.31,"enisaIdProduct":[{"id":"cc27bfec-b12b-3cea-8aea-417b0baf3935","product":{"name":"Apostrophe ","vendor":{"name":"apostrophecms"}},"product_version":"\u003c 4.34.0"}],"enisaIdVendor":[{"id":"25cc9c98-7bcb-3f0d-8e7d-10f604205dfb","vendor":{"name":"apostrophecms"}}],"enisaIdVulnerability":[{"id":"b2c03cc8-e677-30ab-ad64-ab8d6f4d514a","vulnerability":{"id":"GHSA-vh56-5m88-39rq","description":"ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users","datePublished":"Oct 21, 2026, 5:15:21 PM","dateUpdated":"Oct 21, 2026, 5:15:21 PM","baseScore":0.0,"references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vh56-5m88-39rq\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-112957\nhttps://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498\nhttps://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea\nhttps://github.com/apostrophecms/apostrophe\nhttps://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.34.0\n","enisa_id":"EUVD-2026-105170\n","aliases":"GHSA-vh56-5m88-39rq\nCVE-2026-112957\n","epss":0.0,"dataProcessed":"Oct 27, 2026, 7:03:17 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"dc976a10-803f-307e-be7d-8e7d2456d86c","vulnerability":{"id":"CVE-2026-112957","description":"ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the getOne REST endpoint for pages does not apply viewRole type-level restrictions or viewPermission field-level redaction. An editor-level user who knows a document _id can read the full content of admin-only pages and their privileged fields, while the getAll endpoint correctly enforces both restrictions. This issue is fixed in version 4.34.0.","datePublished":"Oct 20, 2026, 4:02:17 PM","dateUpdated":"Oct 21, 2026, 3:53:52 PM","status":"PUBLISHED","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vh56-5m88-39rq\nhttps://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498\nhttps://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea\nhttps://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.34.0\n","enisa_id":"EUVD-2026-105170\n","assigner":"GitHub_M","epss":0.31,"dataProcessed":"Oct 27, 2026, 7:14:58 AM","vulnerabilityProduct":[{"id":"ccda44f5-7428-3b85-b124-e5cd94faf4d6","product":{"name":"Apostrophe ","vendor":{"name":"apostrophecms"}},"product_version":"\u003c 4.34.0"}],"vulnerabilityVendor":[{"id":"95cc6278-19b0-343f-8ac5-ef0e2284b684","vendor":{"name":"apostrophecms"}}]}}],"enisaIdAdvisory":[]}