CVE-2026-112954

CVSS 5.3 (medium) · published 2026-10-20

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a public REST API type that uses publicApiProjection can expose excluded searchable or sortable field information through search membership and sort ordering oracles. Returned fields remain filtered by the projection, so the issue permits targeted inference about hidden values rather than an unrestricted field dump. This issue is fixed in version 4.34.0.

Weakness: CWE-200

Source: NVD CVE-2026-112954

References

• https://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498
• https://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea
• https://github.com/apostrophecms/apostrophe/releases/tag/[email protected]
• https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-rqgm-cfrp-4hx8
• https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-rqgm-cfrp-4hx8

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.