ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users
Summary
The getOne REST endpoint for pages does not apply viewRole type-level restrictions or viewPermission field-level redaction. An editor-level user who knows a document _id can read the full content of admin-only pages and their privileged fields, while the getAll endpoint correctly enforces both restrictions.
Details
Finding 3 — viewRole bypass:
modules/@apostrophecms/page/index.js exposes getRestQuery(req, omitPermissionCheck = false). The getAll path calls publicApiCheckAsync and threads the full query builder pipeline including viewRole filtering. The getOne path uses a divergent code path that skips this pipeline.
A page type declared with viewRole: 'admin' is inaccessible via GET /api/v1/@apostrophecms/page?type=secretPage (returns 403 to an editor) but is fully returned by GET /api/v1/@apostrophecms/page/:id:en:published to the same editor.
Finding 4 — viewPermission field leak:
Fields decorated with viewPermission: { action: 'edit', type: '@apostrophecms/page' } are stripped by removeForbiddenFields in the getAll path but are returned verbatim in getOne. An editor who knows any document _id can read all viewPermission-restricted fields.
PoC
# Log in as editor, get session jar
EDITOR_JAR="..."
# getAll — correctly blocked
curl -b "$EDITOR_JAR" \
"http://TARGET/api/v1/@apostrophecms/page?type=secretPage"
# → 403 Forbidden
# getOne — bypassed, returns full document including viewPermission fields
curl -b "$EDITOR_JAR" \
"http://TARGET/api/v1/@apostrophecms/page/ADMIN_PAGE_ID:en:published"
# → 200 OK, full doc including secretField valueImpact
Editors can read the full content of any page — including those restricted to admins via viewRole — if they know or can guess the _id. Sensitive field values gated by viewPermission are also fully exposed. This breaks the content access control model for any site using these decorators.
What to do
Upgrade the apostrophe package to version 4.34.0 or later.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | apostrophe | < 4.34.0 | 4.34.0 |
References
- https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vh56-5m88-39rq
- https://nvd.nist.gov/vuln/detail/CVE-2026-112957
- https://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498
- https://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea
- https://github.com/apostrophecms/apostrophe
- https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.34.0
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N- Weakness (CWE)
CWE-862- Platform
- npm
- Package
apostrophe- Disclosed
- 21.10.2026
- Updated
- 21.10.2026 20:25
Sources and licenses · Edited or translated by DockRay; source rights and applicable licenses are retained.
OSV / GitHub Advisory Database - GHSA-vh56-5m88-39rq - CC BY 4.0
Vulnerability history: apostrophe
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 33
- First → latest
- 09.2020 10.2026
- Without a fix
- 4
- Exploited in attacks
- 0
Severity breakdown
- Critical 2
- High 9
- Medium 18
- Low 4
Disclosures per year
- 2020: 2
- 2021: 2
- 2022: 0
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 29
-
ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.