CVE-2026-112957 apostrophecms CVE debrief

Who should care

Editor-level users with access to document _id values, administrators responsible for ApostropheCMS instances, and security teams monitoring for potential abuse of the getOne endpoint.

Why it matters

Defenders should prioritize verifying exposure and assessing potential impact, focusing on editor-level users with access to document _id values, and apply the fix to prevent abuse.

• Potential unauthorized access to admin-only pages and privileged fields by lower-privileged users
• Possible data exposure or leakage of sensitive information
• Need for verification of exposure and assessment of potential impact
• Priority for applying the fix to prevent abuse

Technical summary

The getOne REST endpoint for pages in ApostropheCMS does not apply viewRole type-level restrictions or viewPermission field-level redaction, allowing lower-privileged users to access admin-only pages and privileged fields if they know the document _id. This issue is caused by a code path divergence in the getOne endpoint that skips viewRole filtering and viewPermission field-level redaction. The fix involves updating to ApostropheCMS version 4.34.0 or later, which correctly enforces these restrictions. Defenders should prioritize verifying exposure and assessing potential impact, focusing on editor-level users with access to document _id values.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact, focusing on editor-level users with access to document _id values.

Recommended defensive actions

• Verify exposure by checking if the ApostropheCMS instance uses the vulnerable getOne REST endpoint for pages
• Assess potential impact by identifying editor-level users with access to document _id values
• Apply the fix by updating to ApostropheCMS version 4.34.0 or later
• Monitor for potential abuse of the getOne endpoint by lower-privileged users
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The source corpus provides details on the viewRole bypass and viewPermission field leak in the ApostropheCMS getOne REST endpoint for pages. The vulnerability is caused by a divergent code path in the getOne endpoint that skips the viewRole filtering and viewPermission field-level redaction applied in the getAll endpoint. Editor-level users who know a document _id can exploit this to access admin-only pages and privileged fields. Evidence limits suggest verifying exposure and assessing impact are crucial. Defensive verification tasks

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.