CVE-2026-110904 in ApostropheCMS
Summary
by MITRE • 10/15/2026
ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated by a /api/v1/@apostrophecms/page?all=1 call.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in ApostropheCMS versions prior to 4.33.0 represents a critical security flaw within the platform's RESTful application programming interface (API) subsystem, specifically affecting the page retrieval mechanism. This authentication bypass allows unauthenticated actors to access sensitive content and structural data that should be restricted to authorized users or administrators. The core of the issue lies in how the API endpoint /api/v1/@apostrophecms/page handles query parameters, particularly when specific flags such as all=1 are passed during a request. In these earlier versions, the server-side logic fails to properly enforce access control checks before processing the request and returning data, effectively treating unauthenticated requests with the same privilege level as authenticated ones for this specific endpoint.
From a technical perspective, the flaw stems from an incomplete implementation of authorization controls within the API router or controller layer responsible for handling page-related operations. When a client sends a GET request to /api/v1/@apostrophecms/page?all=1 without providing valid session credentials or authentication tokens, the application does not adequately verify whether the requester has permission to view all pages or specific content structures. This oversight allows an attacker to enumerate site architecture, retrieve unpublished drafts, access restricted media assets, and potentially gather information useful for further exploitation attempts such as social engineering or targeted attacks against known administrators based on exposed metadata.
The operational impact of this vulnerability is significant for organizations relying on ApostropheCMS for public-facing websites or internal portals where content confidentiality is paramount. By bypassing authentication, attackers can gain read-only access to the entire site structure and its contents without needing valid credentials. This exposure violates fundamental security principles regarding data integrity and confidentiality. For businesses using the CMS for e-commerce, customer support, or corporate communications, this could lead to intellectual property theft, leakage of proprietary business strategies contained in draft pages, or compromise of user privacy if personal data is stored within accessible page content. Furthermore, the ability to map out the site structure aids attackers in identifying other potential weak points such as outdated plugins, misconfigured servers, or additional API endpoints that may also suffer from similar authorization flaws.
This vulnerability aligns with CWE-287, which describes Improper Authentication, and more specifically CWE-306, Missing Authentication for Critical Function, as the system fails to require appropriate authentication before performing a critical operation like retrieving all page data. In terms of attack vectors, it corresponds to MITRE ATT&CK technique T1078, Valid Accounts, although in this case, no valid account is actually required due to the bypass mechanism. It also relates to reconnaissance activities under T1592, Gather Victim Host Information, as attackers can use the exposed data to build a detailed profile of the target environment.
To mitigate this risk, organizations running ApostropheCMS must immediately upgrade to version 4.33.0 or later, where these authorization checks have been corrected and enforced properly for all API endpoints including /api/v1/@apostrophecms/page. Until an upgrade is feasible, administrators should consider implementing network-level controls such as Web Application Firewalls (WAFs) that can detect and block requests containing suspicious query parameters like all=1 directed at the page API endpoint. Additionally, enabling strict logging and monitoring for unusual access patterns to REST APIs can help in early detection of exploitation attempts. Regular security audits focusing on authentication and authorization logic across all exposed interfaces are recommended to prevent similar vulnerabilities from being introduced or overlooked in future updates.