CVE-2026-110904
Deferred Deferred - Pending Action

Authentication Bypass in ApostropheCMS REST API

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: MITRE

Description
ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated by a /api/v1/@apostrophecms/page?all=1 call.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-19
AI Q&A
2026-10-15
EPSS Evaluated
2026-10-18
NVD
CVE-2026-110904
EUVD
EUVD-2026-101804

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apostrophecms ApostropheCMS 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ApostropheCMS before version 4.33.0 has an authentication bypass vulnerability in its REST API. This flaw allows unauthenticated users or low-privilege contributors to read non-public pages, including admin-only and private pages, by exploiting specific API endpoints like /api/v1/@apostrophecms/page?all=1.

Detection Guidance

Check if your ApostropheCMS version is below 4.33.0 by running: npm list apostrophecms or checking the admin panel. Test for unauthorized access by attempting to access /api/v1/@apostrophecms/page?all=1 without authentication. Monitor logs for unusual REST API requests to this endpoint.

Impact Analysis

This vulnerability could allow attackers to access sensitive page content, including restricted admin pages or private site structure, without proper authorization. It may lead to data leaks or unauthorized information disclosure.

Compliance Impact

This vulnerability could violate compliance requirements for data protection regulations like GDPR or HIPAA by enabling unauthorized access to sensitive or private information. Organizations may face legal or regulatory penalties if such breaches occur.

Mitigation Strategies

Upgrade ApostropheCMS to version 4.33.0 or later immediately. Remove .permission(false) from the getOne method and all handler in the codebase. Reapply type-specific viewRole thresholds and visibility criteria as recommended in the advisory.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110904. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart