CVE-2026-112957
Received Received - Intake

ApostropheCMS Privilege Escalation via Page Content Exposure

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: GitHub, Inc.

Description
ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the getOne REST endpoint for pages does not apply viewRole type-level restrictions or viewPermission field-level redaction. An editor-level user who knows a document _id can read the full content of admin-only pages and their privileged fields, while the getAll endpoint correctly enforces both restrictions. This issue is fixed in version 4.34.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-112957
EUVD
EUVD-2026-105170

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apostrophecms apostrophe < 4.34.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ApostropheCMS versions before 4.34.0 have a flaw in the getOne REST endpoint for pages. This endpoint fails to enforce viewRole restrictions or viewPermission field redaction, allowing editor-level users with knowledge of a document _id to read admin-only pages and privileged fields. The getAll endpoint correctly applies these restrictions.

Detection Guidance

Check ApostropheCMS version with npm list apostrophe or grep package.json. Inspect network logs for GET requests to /api/v1/@apostrophecms/page/:id with editor-level credentials returning admin page content.

Impact Analysis

If you are an editor or lower-privileged user in ApostropheCMS prior to 4.34.0, you could access sensitive admin-only pages and privileged fields by knowing their document _id. This could lead to unauthorized data exposure or information leaks.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating compliance requirements such as GDPR or HIPAA. Exposure of privileged fields or admin-only pages may result in data breaches or unauthorized disclosures.

Mitigation Strategies

Upgrade ApostropheCMS to version 4.34.0 or later immediately. Review and restrict editor-level user permissions. Audit recent GET /api/v1/@apostrophecms/page/:id requests for unauthorized access to admin pages.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112957. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart