PT-2026-33170 · Unknown · Apostrophe Cms

Published 2026-04-15 · Updated 2026-04-16 · CVE-2026-33888

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.29.0

Description An authorization bypass exists in the getRestQuery() function of the @apostrophecms/piece-type module. The function checks if a MongoDB projection is already set before applying the administrator-configured publicApiProjection. An unauthenticated attacker can provide a project query parameter in a REST API request, which is processed by applyBuildersSafely() before the permission check. This pre-populates the projection state, causing the system to skip the publicApiProjection entirely. Consequently, this allows the disclosure of any field on publicly queryable documents that the administrator explicitly restricted from the public API, such as internal notes, draft content, or metadata.

Recommendations Update to version 4.29.0.

Fix

Incorrect Authorization

Information Disclosure

Weakness Enumeration

CWE-863

CWE-200

Related Identifiers

CVE-2026-33888

GHSA-XHQ9-58FW-859P

Affected Products

Apostrophe Cms

References · 7

• https://github.com/apostrophecms/apostrophe/commit/6c2b548dec2e3f7a82e8e16736603f4cd17525aa · Patch
• https://github.com/apostrophecms/apostrophe/commit/00d472804bb622df36a761b6f2cf2b33b2d4ce80 · Patch
• https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-xhq9-58fw-859p · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xhq9-58fw-859p · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33888 · Security Note
• https://github.com/apostrophecms/apostrophe · Note
• https://twitter.com/CVEnew/status/2044701622102786140 · Twitter Post