ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a public REST API type that uses publicApiProjection can expose excluded searchable or sortable field information through search membership and sort ordering oracles. Returned fields remain filtered by the projection, so the issue permits targeted inference about hidden values rather than an unrestricted field dump. This issue is fixed in version 4.34.0.

Source published

20 Oct 2026 15:51:01 UTC

Source modified

23 Oct 2026 01:50:55 UTC

Observed here

23 Oct 2026 16:01:20 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a public REST API type that uses publicApiProjection can expose excluded searchable or sortable field information through search membership and sort ordering oracles. Returned fields remain filtered by the projection, so the issue permits targeted inference about hidden values rather than an unrestricted field dump. This issue is fixed in version 4.34.0.

Source published

Oct 20, 2026, 3:51:01 PM (timezone not stated)

Source modified

Oct 23, 2026, 1:50:55 AM (timezone not stated)

Observed here

7 Nov 2026 04:33:53 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 3.1 · 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a public REST API type that uses publicApiProjection can expose excluded searchable or sortable field information through search membership and sort ordering oracles. Returned fields remain filtered by the projection, so the issue permits targeted inference about hidden values rather than an unrestricted field dump. This issue is fixed in version 4.34.0.

Source published

20 Oct 2026 16:17:06 UTC

Source modified

23 Oct 2026 02:16:55 UTC

Observed here

25 Oct 2026 05:17:18 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · [email protected] · Secondary · 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

### Summary ApostropheCMS lets a module expose an anonymous read API by setting `publicApiProjection`, which whitelists the document fields unauthenticated callers may see. The public REST GET handler applies every launderable query builder from the query string *before* forcing that projection. Two of those builders, `search` and `sort`, operate on the underlying documents rather than the projected output, and neither is checked against the projection. An unauthenticated attacker can therefore: - use `?search=<word>` as a **value oracle** to confirm and locate documents by the content of a field the projection was meant to hide, and - use `?sort[hiddenField]=1` as an **ordering oracle** to rank documents by a hidden field's value. This is the same confidentiality-bypass class already patched for the `choices`/`counts` builders (gated by `choicesFieldAllowedByProjection`). That gate was never applied to `search` or `sort`. ### Details For an anonymous caller, `getRestQuery` (piece types: `modules/@apostrophecms/piece-type/index.js:1142`; pages: `modules/@apostrophecms/page/index.js`) does: ```js const query = self.find(req).attachments(true); query.applyBuildersSafely(req.query); // (1) apply ALL launderable builders from the query string ... query.project({ ...self.options.publicApiProjection, cacheInvalidatedAt: 1 }); // (2) force read projection query.set('publicApiProjection', self.options.publicApiProjection); // (3) used only by the choices/counts gate ``` `applyBuildersSafely` (`modules/@apostrophecms/doc-type/index.js:3327`) runs any builder that has a `launder` method. `search` and `sort` both have one (`doc-type/index.js:2288` and `2127`), so `?search=` and `?sort[...]=` are honored for anonymous requests. **Search vector.** The `search` builder adds `{ $text: { $search: <user input> } }` (`doc-type/index.js:2282`). The `$text` index covers `highSearchText` / `lowSearchText` / `title` / `searchBoost` (`modules/@apostrophecms/doc/index.js:612`). `highSearchText` / `lowSearchText` are built at save time by `@apostrophecms/search:getSearchTexts` → `apos.schema.indexFields(schema, doc, texts)` (`modules/@apostrophecms/search/index.js:377`), which indexes every schema field where `searchable !== false` (the default for string/text fields). `publicApiProjection` does not imply `searchable: false`. Step (2) narrows the output but not the `$text` filter, so the response returns the projected `{title, slug, _id}` of exactly the documents whose hidden field contains the searched word. **Sort vector.** `finalizeSort` (`doc-type/index.js:3526`) forwards raw user sort keys to MongoDB (it only rewrites fields flagged `sortify: true`). `?sort[hiddenField]=1` orders results by a projection-excluded field. Combined with `perPage`/`page`, an attacker can page through the fully ordered set. Neither builder consults `publicApiProjection`, whereas `choices`/`counts` are gated at `doc-type/index.js:2807` via `choicesFieldAllowedByProjection`. ### PoC **Preconditions:** the piece/page type sets `publicApiProjection`, and its schema has at least one searchable (default) or sortable field not included in the projection. Test type: `article` exposes only `title`, `slug`, `_id`, but has hidden `secret` (integer) and `secretNote` (searchable string): ```js export default { extend: '@apostrophecms/piece-type', options: { publicApiProjection: { title: 1, slug: 1, _id: 1 } }, fields: { add: { secret: { type: 'integer' }, secretNote: { type: 'string' } // searchable by default; NOT in the projection } } }; ``` Five articles were inserted and published via the authenticated REST API: `A.secret=50, secretNote="zzsecretalpha"`; `B=10/zzsecretbravo`; `C=90/zzsecretcharlie`; `D=30/zzsecretdelta`; `E=70/zzsecretecho`. The insert responses confirm the hidden `secretNote` value is written into the search index, e.g. for A: `"highSearchText": "... zzsecretalpha"`, `"lowSearchText": "... zzsecretalpha"`. Anonymous requests (no credentials, no session): ```bash # [1] Baseline: projection hides secret/secretNote on direct read curl -s 'http://localhost:3000/api/v1/article?perPage=1' # [2] Search oracle: value exists ONLY in hidden secretNote curl -s 'http://localhost:3000/api/v1/article?search=zzsecretalpha' curl -s 'http://localhost:3000/api/v1/article?search=zznotpresentxyz' # [3] Sort oracle: order by hidden integer field curl -s 'http://localhost:3000/api/v1/article?sort%5Bsecret%5D=1' curl -s 'http://localhost:3000/api/v1/article?sort%5Bsecret%5D=-1' # Negative control: projection override is blocked curl -s 'http://localhost:3000/api/v1/article?project%5BsecretNote%5D=1&perPage=1' ``` Results (verified on ApostropheCMS 4.32.2, MongoDB 7.0): | Request (anonymous) | Observed | Verdict | | ------------------------- | ------------------------------------------------- | ------------------------------------- | | `GET /api/v1/article` | `_id,title,slug,type,metaType,cacheInvalidatedAt` | projection works on direct read | | `?search=zzsecretalpha` | only Article A (with textScore) | **leak**: locates doc by hidden field | | `?search=zznotpresentxyz` | 0 results | oracle confirmed | | `?sort[secret]=1` | B, D, A, E, C (= 10,30,50,70,90) | **leak**: full hidden ordering | | `?sort[secret]=-1` | C, E, A, D, B | reverse confirmed | | `?project[secretNote]=1` | secretNote absent | gated (projection override blocked) | ### Impact Unauthenticated, network-reachable partial disclosure of fields the developer explicitly restricted with `publicApiProjection`: - **Search oracle:** confirm and locate documents by words in hidden fields (e.g. internal notes, contact emails, draft metadata, moderation/status flags), returning the `title`/`slug`/`_id` of matches. - **Sort oracle:** full ordering of documents by a hidden field. With one known reference value or a paging binary search, exact hidden values can be recovered. No authentication or user interaction required. Not a full field dump, but a targeted oracle over exactly the data the projection is meant to conceal. Affects sites that configure `publicApiProjection` on piece types or pages, up to and including 4.32.2 (same code path present on current `main`). ### Remediation Gate `search`, `sort` (and `autocomplete`, which feeds `search`) on the public API path the same way `choices`/`counts` are gated. When `publicApiProjection` is in force: - **sort:** reject or drop any sort key not permitted by the projection, reusing `choicesFieldAllowedByProjection`. - **search:** restrict full-text search to fields the projection exposes (e.g. a projection-scoped search text), or refuse the `search` builder when the projection excludes any searchable field.

Source published

21 Oct 2026 17:12:15 UTC

Source modified

21 Oct 2026 17:15:08 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Publisher rating · MODERATE