CVE-2026-113653 apostrophecms CVE debrief

Who should care

ApostropheCMS users, developers, and administrators who have exposed user objects through relationships or APIs. These stakeholders should assess exposure and prioritize verification of user object access controls due to a vulnerability allowing public access to @apostrophecms/user objects without proper viewRole application.

Why it matters

ApostropheCMS users should assess exposure and prioritize verification of user object access controls due to a vulnerability allowing public access to @apostrophecms/user objects without proper viewRole application.

• Potential disclosure of user fields through publicly accessible relationships or APIs
• Need to verify and update to version 4.33.0 or later
• Monitoring for unusual access patterns to user objects may be necessary

Technical summary

ApostropheCMS versions prior to 4.33.0 do not apply viewRole to anonymous visitors when user objects are exposed through publicly rendered relationships or public APIs. This can lead to disclosure of user fields if templates are not properly limited. The issue is fixed in version 4.33.0. Developers should assess exposure and prioritize verification of user object access controls, especially for publicly rendered relationships or APIs. Inadequately limited templates, including serialization of an entire related user object, can conditionally disclose user fields, but relationships do not automatically publish full user objects and password hashes are stored separately and are not affected.

Defensive priority

Medium priority for ApostropheCMS users to verify and update

Recommended defensive actions

• Verify if publicly rendered relationships or APIs expose user objects in ApostropheCMS
• Update to ApostropheCMS version 4.33.0 or later
• Monitor for unusual access patterns to user objects
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability in ApostropheCMS versions prior to 4.33.0. The issue is fixed in version 4.33.0. Defenders should verify if their configurations expose user objects and update to version 4.33.0 or later. This may involve reviewing publicly rendered relationships or APIs, checking for inadequate template limitations, and monitoring for unusual user object access patterns.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.