CVE-2026-112954

Published: Oct 20, 2026Modified: Oct 23, 2026Deferred

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: security-advisories@github.com (Secondary)

Description

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a public REST API type that uses publicApiProjection can expose excluded searchable or sortable field information through search membership and sort ordering oracles. Returned fields remain filtered by the projection, so the issue permits targeted inference about hidden values rather than an unrestricted field dump. This issue is fixed in version 4.34.0.

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (5)

https://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498

Source: security-advisories@github.com

https://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea

Source: security-advisories@github.com

https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.34.0

Source: security-advisories@github.com

https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-rqgm-cfrp-4hx8

Source: security-advisories@github.com

https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-rqgm-cfrp-4hx8

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.