CVE-2026-112954 apostrophecms CVE debrief

Who should care

Defenders responsible for ApostropheCMS installations should be aware of this vulnerability and take steps to verify their exposure and apply necessary patches or compensating controls. This includes developers, system administrators, and security professionals responsible for maintaining ApostropheCMS-based systems.

Why it matters

This vulnerability allows unauthenticated attackers to bypass the publicApiProjection setting in ApostropheCMS, potentially leading to unauthorized access to sensitive information. Defenders should prioritize verifying their installations, assessing exposure, and applying necessary patches or compensating controls.

• Defenders need to verify if their ApostropheCMS installations are vulnerable and prioritize patching or applying compensating controls.
• Unauthenticated attackers can use the 'search' and 'sort' query builders to bypass the publicApiProjection setting and access sensitive fields.
• This vulnerability can lead to unauthorized access to sensitive information stored in ApostropheCMS documents.
• Defenders should monitor for potential exploitation attempts and adjust defensive measures accordingly.

Technical summary

The public REST API in ApostropheCMS applies query builders from the query string before enforcing the publicApiProjection setting. This allows unauthenticated attackers to bypass the projection and access sensitive fields using the 'search' and 'sort' query builders. Affected product deployments should be verified, and defenders should consider upgrading to a fixed version or applying compensating controls to restrict access to sensitive fields. The vulnerability can be mitigated by reviewing and adjusting the configuration of the publicApiProjection setting and ensuring that proper access controls are in place.

Defensive priority

Defenders should prioritize verifying their ApostropheCMS installations and assessing their exposure to this vulnerability. This involves checking if the version of ApostropheCMS being used is vulnerable and if the publicApiProjection setting is being used. If so, defenders should consider upgrading to a fixed version or applying compensating controls to restrict access to sensitive fields.

Recommended defensive actions

• Verify the version of ApostropheCMS being used and check if it is vulnerable.
• Assess the exposure of the ApostropheCMS installation to this vulnerability.
• Consider upgrading to a fixed version of ApostropheCMS or applying compensating controls to restrict access to sensitive fields.
• Monitor for potential exploitation attempts and adjust defensive measures accordingly.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The evidence for this vulnerability comes from the ApostropheCMS source code and the OSV vulnerability database. The vulnerability was introduced in an earlier version of ApostropheCMS and was fixed in version 4.34.0. The public REST API's handling of query builders and projections was not properly restricted, allowing for the bypass of the publicApiProjection setting.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.