Authorization Bypass in ApostropheCMS Affects Open-Source Node.js Content Management System
CVE-2026-39857

5.3MEDIUM

Key Information:

Vendor

Apostrophecms

Status
Apostrophe
Vendor
CVE Published:
15 April 2026

What is CVE-2026-39857?

ApostropheCMS, an open-source Node.js content management system, has a vulnerability that allows for authorization bypass through the choices and counts query parameters in its REST API. This issue affects versions 4.28.0 and earlier, allowing unauthenticated attackers to access sensitive information. Specifically, the vulnerability allows attackers to retrieve all distinct field values from any schema field, including those marked for protection by viewPermission. The MongoDB distinct() operation fails to adhere to intended publicApiProjection restrictions, exposing excessive data in API responses. The affected APIs include the piece-type and page REST APIs, and the vulnerability has been addressed in version 4.29.0.

Affected Version(s)

apostrophe < 4.29.0

References

https://github.com/apostrophecms/apostrophe/security/advi...
x_refsource_CONFIRM
https://github.com/apostrophecms/apostrophe/commit/6c2b54...
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.