Security Flaw in ApostropheCMS Core Page API Leads to Data Exposure

CVE-2026-113670

What is CVE-2026-113670?

A serious security flaw was identified in ApostropheCMS affecting versions prior to 4.33.0. The core page REST API fails to enforce proper access controls, allowing unauthenticated users and low-privilege contributors to access restricted page content, including admin-only pages. This vulnerability permits unauthorized viewing of sensitive information via the page's _id or slug, undermining the intended privacy controls of visibility statuses such as private and loginRequired. The issue was addressed in the release of version 4.33.0.

References