CVE-2026-113653: ApostropheCMS User Object Exposure Vulnerability
Summary
CVE-2026-113653: Impact Even though it is correctly applied to guests, contributors, etc., viewRole is not applied to the general public. Affects apostrophe versions < 4.33.0. Fixed in 4.33.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
ApostropheCMS is a powerful open-source content management system (CMS) designed for building websites and applications with a focus on ease of use and flexibility. It allows developers to create custom content types and manage relationships between them. However, a recent vulnerability has been identified that affects the security of user objects within the system, potentially exposing sensitive information to the general public.
Vulnerability Detail
The vulnerability arises from the improper application of the 'viewRole' permission for the '@apostrophecms/user' objects, which allows the general public to access these objects through relationships. Although the system correctly restricts access for guests and contributors, the lack of restrictions for the general public can lead to unintended exposure of sensitive user information if developers mistakenly create relationships that include user objects. This risk is somewhat mitigated by the absence of an automatic public REST API for content types, but developers may inadvertently expose user data through poorly designed templates.
How To Fix
Latest published version: 4.34.0 as of 23 Oct 2026
npm install apostrophe@4.34.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.33.0
This is the first release that contains the fix.
npm install apostrophe@4.33.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid creating relationships with '@apostrophecms/user' that are intended for non-admin display. Instead, create a separate author piece type to publicly represent authorship without exposing sensitive user information.
Conclusion
In summary, the CVE-2026-113653 vulnerability in ApostropheCMS exposes user objects to the general public due to improper permission settings. It is crucial to update to version 4.33.0 or later to mitigate this risk. Developers should also be cautious about how they create relationships involving user objects to prevent unintentional data exposure.
See every vulnerability recorded for apostrophe →
FAQ
The vulnerability allows the general public to access '@apostrophecms/user' objects due to improper permission settings.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include the exposure of sensitive user information if developers create relationships that inadvertently allow public access to user objects.
Yes, a patch is available in version 4.33.0 of ApostropheCMS. Updating to this version will resolve the vulnerability.
If you cannot update immediately, avoid creating public relationships with '@apostrophecms/user' and consider using a separate author piece type.
References
Related vulnerabilities
Recent vulnerabilities recorded for apostrophe.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
