Vulnerability · Published Oct 20, 2026 · Assigned by GitHub_M

CVE-2026-112954ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API

Medium 5.3

In plain English

A medium-severity information exposure in apostrophe from apostrophecms. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.4%top 61.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a public REST API type that uses publicApiProjection can expose excluded searchable or sortable field information through search membership and sort ordering oracles. Returned fields remain filtered by the projection, so the issue permits targeted inference about hidden values rather than an unrestricted field dump. This issue is fixed in version 4.34.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	apostrophe	4.34.0	GHSA-rqgm-cfrp-4hx8

Affected products (as reported)

Vendor	Product	Versions
apostrophecms	apostrophe	< 4.34.0

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-rqgm-cfrp-4hx8 x_refsource_CONFIRM
https://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498 x_refsource_MISC
https://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea x_refsource_MISC
https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.34.0 x_refsource_MISC