ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the getOne REST endpoint for pages does not apply viewRole type-level restrictions or viewPermission field-level redaction. An editor-level user who knows a document _id can read the full content of admin-only pages and their privileged fields, while the getAll endpoint correctly enforces both restrictions. This issue is fixed in version 4.34.0.

Source published

20 Oct 2026 16:02:17 UTC

Source modified

21 Oct 2026 15:53:52 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the getOne REST endpoint for pages does not apply viewRole type-level restrictions or viewPermission field-level redaction. An editor-level user who knows a document _id can read the full content of admin-only pages and their privileged fields, while the getAll endpoint correctly enforces both restrictions. This issue is fixed in version 4.34.0.

Source published

Oct 20, 2026, 4:02:17 PM (timezone not stated)

Source modified

Oct 21, 2026, 3:53:52 PM (timezone not stated)

Observed here

7 Nov 2026 04:33:57 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 3.1 · 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the getOne REST endpoint for pages does not apply viewRole type-level restrictions or viewPermission field-level redaction. An editor-level user who knows a document _id can read the full content of admin-only pages and their privileged fields, while the getAll endpoint correctly enforces both restrictions. This issue is fixed in version 4.34.0.

Source published

20 Oct 2026 17:17:33 UTC

Source modified

21 Oct 2026 16:17:15 UTC

Observed here

25 Oct 2026 05:17:18 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · [email protected] · Secondary · 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

### Summary The `getOne` REST endpoint for pages does not apply `viewRole` type-level restrictions or `viewPermission` field-level redaction. An editor-level user who knows a document `_id` can read the full content of admin-only pages and their privileged fields, while the `getAll` endpoint correctly enforces both restrictions. ### Details **Finding 3 — viewRole bypass:** `modules/@apostrophecms/page/index.js` exposes `getRestQuery(req, omitPermissionCheck = false)`. The `getAll` path calls `publicApiCheckAsync` and threads the full query builder pipeline including `viewRole` filtering. The `getOne` path uses a divergent code path that skips this pipeline. A page type declared with `viewRole: 'admin'` is inaccessible via `GET /api/v1/@apostrophecms/page?type=secretPage` (returns 403 to an editor) but is fully returned by `GET /api/v1/@apostrophecms/page/:id:en:published` to the same editor. **Finding 4 — viewPermission field leak:** Fields decorated with `viewPermission: { action: 'edit', type: '@apostrophecms/page' }` are stripped by `removeForbiddenFields` in the `getAll` path but are returned verbatim in `getOne`. An editor who knows any document `_id` can read all `viewPermission`-restricted fields. ### PoC ```bash # Log in as editor, get session jar EDITOR_JAR="..." # getAll — correctly blocked curl -b "$EDITOR_JAR" \ "http://TARGET/api/v1/@apostrophecms/page?type=secretPage" # → 403 Forbidden # getOne — bypassed, returns full document including viewPermission fields curl -b "$EDITOR_JAR" \ "http://TARGET/api/v1/@apostrophecms/page/ADMIN_PAGE_ID:en:published" # → 200 OK, full doc including secretField value ``` ### Impact Editors can read the full content of any page — including those restricted to admins via `viewRole` — if they know or can guess the `_id`. Sensitive field values gated by `viewPermission` are also fully exposed. This breaks the content access control model for any site using these decorators.

Source published

21 Oct 2026 17:15:21 UTC

Source modified

21 Oct 2026 17:28:22 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Publisher rating · MODERATE