CVE-2026-112954

Deferred Deferred - Pending Action

ApostropheCMS Information Exposure via Public API Projection

Publication date: 2026-10-20

Last updated on: 2026-10-23

Assigner: GitHub, Inc.

Description

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a public REST API type that uses publicApiProjection can expose excluded searchable or sortable field information through search membership and sort ordering oracles. Returned fields remain filtered by the projection, so the issue permits targeted inference about hidden values rather than an unrestricted field dump. This issue is fixed in version 4.34.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-23

Generated

2026-11-10

AI Q&A

2026-10-20

EPSS Evaluated

2026-11-08

NVD

CVE-2026-112954

EUVD

EUVD-2026-105104

Affected Vendors & Products

Vendor	Product	Version / Range
apostrophecms	apostrophe	< 4.34.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

ApostropheCMS versions before 4.34.0 have a vulnerability where the public REST API's search and sort functions can leak data from fields that should be hidden by publicApiProjection. Attackers can use search to find documents containing specific words in excluded fields and sort to reveal hidden field values through pagination. The API still returns only projected fields, but sensitive data can be inferred.

Detection Guidance

To detect this vulnerability, check if your ApostropheCMS version is prior to 4.34.0. Use commands like 'npm list apostrophe' or check the version in package.json. Test the public REST API endpoints for search and sort parameters that may expose hidden fields.

Impact Analysis

Unauthenticated attackers could access sensitive information like internal notes, contact emails, or metadata by exploiting search and sort functions. This could lead to data breaches, privacy violations, or unauthorized knowledge of restricted content. The attack requires no user interaction or authentication.

Compliance Impact

This vulnerability could violate GDPR's data minimization principle and HIPAA's safeguards for protected health information by exposing sensitive data through inference. Organizations using affected versions may face compliance violations, legal penalties, or reputational damage due to unauthorized data exposure.

Mitigation Strategies

Immediately upgrade ApostropheCMS to version 4.34.0 or later. If upgrading is not possible, restrict access to the public REST API endpoints by implementing authentication or IP-based restrictions. Review API responses to ensure no sensitive fields are exposed.

Hi! I’m here to help you understand CVE-2026-112954. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...