ApostropheCMS: General public can access @apostrophecms/user objects via a relationship
Impact
Even though it is correctly applied to guests, contributors, etc., viewRole is not applied to the general public. This means that a secured content type like @apostrophecms/user can in theory be accessed.
This is greatly mitigated by the fact that there is no automatic public REST API for any content type. One has to expressly allow it. However, it does mean that developers can make the mistake of setting up a relationship between a content type like a blog post, and @apostrophecms/user. This could potentially expose some sensitive information if templates were written poorly, e.g. if they JSON-serialized the entire object. Note that password hashes are NOT affected because they reside in a separate collection.
The public demo project and its various flavors must be updated first because it inadvertently relies on the bug.
Patches
4.33.0
Workarounds
Never create relationships with @apostrophecms/user that are intended for non-admin display. If you need a relationship that expresses authorship, create a separate author piece type to publicly represent that.
What to do
Update to version 4.33.0 or later. As a workaround, avoid creating relationships with @apostrophecms/user meant for non-admin display, and use a dedicated piece type to represent authorship publicly.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | apostrophe | < 4.33.0 | 4.33.0 |
References
- https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-xf6w-q65w-4f2w
- https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce
- https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350
- https://github.com/apostrophecms/apostrophe
- https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N- Weakness (CWE)
CWE-863- Platform
- npm
- Package
apostrophe- Disclosed
- 20.10.2026
- Updated
- 20.10.2026 21:36
Sources and licenses · Edited or translated by DockRay; source rights and applicable licenses are retained.
OSV / GitHub Advisory Database - GHSA-xf6w-q65w-4f2w - CC BY 4.0
Vulnerability history: apostrophe
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 27
- First → latest
- 09.2020 10.2026
- Without a fix
- 4
- Exploited in attacks
- 0
Severity breakdown
- Critical 2
- High 8
- Medium 13
- Low 4
Disclosures per year
- 2020: 2
- 2021: 2
- 2022: 0
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 23
-
ApostropheCMS: General public can access @apostrophecms/user objects via a relationship this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.