Exposure of Sensitive Data in ApostropheCMS Prior to Version 4.34.0

CVE-2026-112954

What is CVE-2026-112954?

ApostropheCMS, the open-source Node.js content management system, has a vulnerability that could allow unauthorized exposure of previously excluded searchable or sortable fields via its public REST API. Specifically, versions prior to 4.34.0 utilize a publicApiProjection that may inadvertently reveal sensitive information about hidden data through search membership and ordering mechanisms. Although the returned fields are filtered, this flaw permits targeted inference that could lead to significant data privacy concerns. This issue is addressed in version 4.34.0, so updating promptly is crucial for maintaining data integrity.

References