ApostropheCMS: Page REST API authorization bypass
Summary
The core page REST API reads full page documents with .permission(false) in getOne and in the all=1 tree dump, bypassing page-type viewRole, visibility: private, and visibility: loginRequired checks. Unauthenticated visitors and low-privilege contributors can read admin-only and non-public page content by _id/slug.
Details
packages/apostrophe/modules/@apostrophecms/page/index.js:
getOne(L456–465):await self.publicApiCheckAsync(req); ... self.getRestQuery(req).permission(false).and(criteria)— noviewRolethreshold, novisibilityfiltering.allhandler (L318–395):getRestQuery(req).permission(false)(L384–385) walks every page type and returns the projection includingvisibility.publicApiCheckAsync(L3044) only checks thatpublicApiProjectionexists — it performs no authorization.- Correct control behaves differently:
piece-type/index.js:getOne(L319–327) usesgetRestQuery(req)without.permission(false)and enforcesviewRole.
Proof of Concept
# Anonymous (no session) — private, admin-only page:
curl "http://localhost:3100/api/v1/@apostrophecms/page/d576242ve1dkzb12jiiabujd:en:published"
# → 200 {"_id":"...:en:published","title":"Secret Private Page","slug":"/secret-page",
# "type":"private-type","visibility":"private","secretData":"TOP-SECRET-VALUE-abc123"}
# Anonymous full site-map dump (includes private + loginRequired pages):
curl "http://localhost:3100/api/v1/@apostrophecms/page?all=1" # → 200, full tree
# Contributor (cont_admin) reads full admin-only doc incl. protected field:
curl -b contrib.cookies ".../api/v1/@apostrophecms/page/d576242ve1dkzb12jiiabujd:en:published"
# → 200 secretData = TOP-SECRET-VALUE-abc123
# Controls (correctly enforced):
curl -b contrib.cookies ".../api/v1/@apostrophecms/page?type=private-type&autocomplete=zz" # → 403
curl -b contrib.cookies ".../api/v1/@apostrophecms/page/d576242ve1dkzb12jiiabujd:en:draft" # → 403Impact
Unauthenticated disclosure of visibility: private and loginRequired pages (full documents, not just paths) and of the complete site structure with visibility/type metadata; contributors read admin-only page types and their protected fields. Because _ids are enumerable and leaked by all=1, this is systemic.
What to do
Upgrade to ApostropheCMS version 4.33.0 or later.
Alternatively, remove .permission(false) from getOne/all or re-apply the type's viewRole threshold plus the same visibility/login-required criteria the list and autocomplete paths use (mirror piece-type); make publicApiCheck config-presence-only and add an explicit authorization step per verb.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | apostrophe | < 4.33.0 | 4.33.0 |
References
- https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-2j32-q6rx-h844
- https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce
- https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350
- https://github.com/apostrophecms/apostrophe
- https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N- Weakness (CWE)
CWE-863- Platform
- npm
- Package
apostrophe- Disclosed
- 20.10.2026
- Updated
- 20.10.2026 21:36
Sources and licenses · Edited or translated by DockRay; source rights and applicable licenses are retained.
OSV / GitHub Advisory Database - GHSA-2j32-q6rx-h844 - CC BY 4.0
Vulnerability history: apostrophe
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 27
- First → latest
- 09.2020 10.2026
- Without a fix
- 4
- Exploited in attacks
- 0
Severity breakdown
- Critical 2
- High 8
- Medium 13
- Low 4
Disclosures per year
- 2020: 2
- 2021: 2
- 2022: 0
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 23
-
ApostropheCMS: Page REST API authorization bypass this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.