CVE-2026-113670 in ApostropheCMS
Summary
by MITRE • 10/20/2026
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the core page REST API reads full page documents with .permission(false) in getOne and in the all=1 tree dump, bypassing page-type viewRole, visibility: private, and visibility: loginRequired checks. Unauthenticated visitors and low-privilege contributors can read admin-only and non-public page content by _id/slug. This issue is fixed in version 4.33.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
ApostropheCMS is an open-source content management system built on the Node.js platform, widely used for creating dynamic websites with robust administrative capabilities. The vulnerability identified involves a critical flaw within the core page REST API implementation, specifically affecting versions prior to 4.33.0. This security defect stems from improper access control mechanisms when retrieving full page documents through specific API endpoints. In particular, the getOne method and the all=1 tree dump functionality utilize a permission bypass technique by invoking .permission(false). This configuration directive effectively disables standard authorization checks that are normally enforced to restrict access based on user roles and visibility settings.
The technical flaw allows unauthenticated visitors as well as low-privilege contributors to read content that is explicitly designated for administrators or restricted users. Normally, ApostropheCMS enforces security policies such as page-type viewRole restrictions, which dictate who can view specific types of pages, and visibility attributes like private or loginRequired, which limit access to authenticated users only. However, due to the bypass in the REST API, these safeguards are ignored when requests are made using a document's _id or slug identifier. Consequently, sensitive administrative content, internal drafts, or confidential information intended for restricted audiences becomes accessible via direct HTTP requests without any authentication credentials.
The operational impact of this vulnerability is significant, as it leads to unauthorized data disclosure and potential exposure of proprietary business logic or personal identifiable information depending on the site's configuration. Attackers can enumerate page slugs or IDs through common patterns or error messages and subsequently retrieve full document contents that should remain hidden. This undermines the integrity of the content management system’s security model and violates fundamental principles of least privilege, where users are granted only the access necessary for their role. The ability to read admin-only pages without authentication represents a severe breach of confidentiality within the application environment.
This vulnerability aligns with CWE-284, which describes Improper Access Control, specifically reflecting failures in enforcing restrictions on authenticated users or unauthenticated actors. It also maps to MITRE ATT&CK techniques related to Discovery and Collection, where adversaries gather information about system resources and data structures to facilitate further exploitation. The root cause lies in the inconsistent application of security middleware across different API methods within the framework’s core logic.
To mitigate this risk, organizations running ApostropheCMS must upgrade immediately to version 4.33.0 or later, which corrects the permission handling logic in the getOne and tree dump operations. Until an update is applied, administrators should consider implementing reverse proxy rules or WAF policies that restrict direct access to internal API endpoints if they are exposed externally. Additionally, reviewing page visibility settings and ensuring no sensitive content relies solely on client-side checks can provide defense-in-depth measures. Regular security audits of custom modules and third-party plugins integrated with the CMS are also recommended to ensure consistent enforcement of role-based access controls across all application surfaces.