CVE-2026-113653
Received Received - Intake

ApostropheCMS Information Disclosure via Unrestricted View Role

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: GitHub, Inc.

Description
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, viewRole is not applied to anonymous visitors when a developer exposes user objects through a publicly rendered relationship or expressly enabled public API. Inadequately limited templates, including serialization of an entire related user object, can conditionally disclose user fields, but relationships do not automatically publish full user objects and password hashes are stored separately and are not affected. This issue is fixed in version 4.33.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-113653
EUVD
EUVD-2026-105181

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apostrophecms apostrophe < 4.33.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ApostropheCMS versions before 4.33.0 have a flaw where the viewRole permission is not enforced for anonymous visitors. This allows public access to user objects through relationships in templates, potentially exposing sensitive user data if developers serialize entire user objects. Password hashes are stored separately and remain unaffected.

Detection Guidance

Check ApostropheCMS version with npm list apostrophe or by inspecting package.json. Look for exposed user objects in templates or custom API endpoints that serialize @apostrophecms/user relationships. Review public demo projects for improper user object exposure.

Impact Analysis

If you use ApostropheCMS prior to 4.33.0, attackers may access user data through public relationships or templates. This could lead to unauthorized exposure of user fields, though full user objects and passwords are not automatically exposed.

Mitigation Strategies

Upgrade to ApostropheCMS 4.33.0 or later. Avoid creating relationships with @apostrophecms/user for non-admin display. Use a separate author piece type for public user representation instead of exposing full user objects.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113653. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart