Node.js Content Management System ApostropheCMS Vulnerability
CVE-2026-112957
4.3MEDIUM
What is CVE-2026-112957?
The ApostropheCMS, an open-source Node.js content management system, contains an access control vulnerability that impacts the getOne REST endpoint for pages. Prior to version 4.34.0, this endpoint failed to enforce viewRole type-level restrictions and viewPermission field-level redaction. As a result, editor-level users with knowledge of a specific document ID could gain unauthorized access to the full content of admin-only pages and their sensitive fields. This issue has been addressed in version 4.34.0, which enhances security by implementing necessary restrictions, while the getAll endpoint continues to function correctly.
Affected Version(s)
apostrophe < 4.34.0