Description
ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a public REST API type that uses publicApiProjection can expose excluded searchable or sortable field information through search membership and sort ordering oracles. Returned fields remain filtered by the projection, so the issue permits targeted inference about hidden values rather than an unrestricted field dump. This issue is fixed in version 4.34.0.
References5
- github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c…
- github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029…
- github.com/apostrophecms/apostrophe/releases/tag/[email protected]…
- github.com/apostrophecms/apostrophe/security/advisories/GHSA-rq…
- github.com/apostrophecms/apostrophe/security/advisories/GHSA-rq…
Metrics
- CVSS 3.1
-
5.3
MEDIUM
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - EPSS — exploit probability
- 0% percentile: 39 · as of 9 November 2026
- CWE
- CWE-200
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.