PT-2026-33173 · Unknown · Apostrophe Cms

Published 2026-04-15 · Updated 2026-04-28 · CVE-2026-39857

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.29.0

Description An authorization bypass exists in the REST API of this open-source Node.js content management system. Unauthenticated attackers can extract all distinct field values for any schema field type that has a registered query builder, including string, integer, float, select, boolean, date, slug, and relationship fields. This occurs because the choices and counts query parameters execute MongoDB distinct() operations that do not respect publicApiProjection restrictions or viewPermission protections intended to limit public field exposure. The counts parameter further reveals the number of documents associated with each distinct value. Both the piece-type and page REST APIs are affected.

Recommendations Update to version 4.29.0. As a temporary workaround, restrict access to the choices and counts query parameters in the REST API to minimize the risk of data extraction.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-39857

GHSA-C276-FJ82-F2PQ

Affected Products

Apostrophe Cms

References · 7

• 🔥 https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-c276-fj82-f2pq · Exploit
• https://github.com/apostrophecms/apostrophe/commit/6c2b548dec2e3f7a82e8e16736603f4cd17525aa · Patch
• https://osv.dev/vulnerability/GHSA-c276-fj82-f2pq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39857 · Security Note
• https://github.com/apostrophecms/apostrophe · Note
• https://twitter.com/_cvereports/status/2049063931793072365 · Twitter Post
• https://twitter.com/CVEnew/status/2044701619049410952 · Twitter Post