CVE-2026-112954: ApostropheCMS Unauthenticated API Bypass via Search and Sort Queries
Summary
CVE-2026-112954: ApostropheCMS lets a module expose an anonymous read API by setting publicApiProjection, which whitelists the document fields unauthenticated callers may see. Affects apostrophe versions < 4.34.0. Fixed in 4.34.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ApostropheCMS is an open-source content management system (CMS) designed for building websites and applications with a focus on ease of use and flexibility. It allows developers to create custom content types and manage them through a user-friendly interface. However, a vulnerability has been identified that affects its public REST API, specifically the handling of unauthenticated requests, which can lead to unauthorized data exposure.
Vulnerability Detail
The vulnerability arises from the way ApostropheCMS handles the 'publicApiProjection' setting, which is intended to restrict the fields visible to unauthenticated users. The public REST API applies query builders like 'search' and 'sort' before enforcing this projection, allowing attackers to exploit these builders to access hidden fields. An unauthenticated attacker can use the 'search' query to confirm the existence of documents based on hidden content and the 'sort' query to order documents by hidden field values. This results in a partial disclosure of sensitive information that the developer intended to restrict.
How To Fix
Latest published version: 4.34.0 as of 23 Oct 2026
npm install apostrophe@4.34.0The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the public API for unauthenticated users or implement additional checks to ensure that the 'search' and 'sort' queries do not expose sensitive fields. However, the best solution is to update to the patched version.
Conclusion
In summary, CVE-2026-112954 is a significant vulnerability in ApostropheCMS that allows unauthenticated users to access restricted data through the public API. It is crucial to update to the latest version to mitigate this risk and protect sensitive information.
See every vulnerability recorded for apostrophe →
FAQ
CVE-2026-112954 is a vulnerability in ApostropheCMS that allows unauthenticated users to bypass restrictions on the public API, potentially exposing sensitive information.
If your application uses ApostropheCMS and has configured 'publicApiProjection', this vulnerability could allow unauthorized users to access hidden fields through search and sort queries.
If an immediate update is not possible, consider restricting access to the public API for unauthenticated users or implementing additional validation on search and sort queries.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your package-lock.json file, you can receive real-time alerts about vulnerabilities. You can also check your application using the Vulert playground without any signup.
The CVSS score for this vulnerability is 5.3, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for apostrophe.
