User Data Exposure in ApostropheCMS 4.33.0 and Earlier

CVE-2026-113653

What is CVE-2026-113653?

ApostropheCMS, a popular open-source Node.js content management system, had a vulnerability in versions prior to 4.33.0. This issue arises when developers expose user objects through publicly rendered relationships or public APIs without appropriate access controls. As a result, there is a potential for unauthorized disclosure of user fields, as the existing views are inadequately restricted. While relationships do not directly expose full user objects, the vulnerability can still lead to conditional leaks of sensitive information. Notably, password hashes remain unaffected as they are stored separately. The vulnerability has been addressed in the release of version 4.33.0.

References