Vulnerability Description
ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a public REST API type that uses publicApiProjection can expose excluded searchable or sortable field information through search membership and sort ordering oracles. Returned fields remain filtered by the projection, so the issue permits targeted inference about hidden values rather than an unrestricted field dump. This issue is fixed in version 4.34.0.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e5
- https://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce76686
- https://github.com/apostrophecms/apostrophe/releases/tag/[email protected]
- https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-rqgm-cfrp-4
- https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-rqgm-cfrp-4
FAQ
What is CVE-2026-112954?
CVE-2026-112954 is a vulnerability with a CVSS score of 5.3 (MEDIUM). ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a public REST API type that uses publicApiProjection can expose excluded searchable or sortable field information th...
How severe is CVE-2026-112954?
CVE-2026-112954 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-112954?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.