Medium severity · published Oct 20, 2026
CVE-2026-112954
ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a public REST API type that uses publicApiProjection can expose excluded searchable or sortable field information through search membership and sort ordering oracles. Returned fields remain filtered by the projection, so the issue permits targeted inference about hidden values rather than an unrestricted field dump. This issue is fixed in version 4.34.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AP
apostrophe · apostrophecms
< 4.34.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-112954
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-112954
github.com
https://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498
github.com
https://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea
github.com
https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.34.0
github.com
https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-rqgm-cfrp-4hx8
More from apostrophe
9.1
CVE-2026-53609
Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass
8.7
CVE-2026-35569
ApostropheCMS: Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS
8.1
CVE-2026-45013
Apostrophe has a Weak Password Recovery Mechanism for Forgotten Password and Improper Input Validation
8.1
CVE-2026-32730
ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware
7.6
CVE-2026-45012
Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widget