CVE-2026-33888 apostrophecms CVE debrief

Who should care

Defenders responsible for ApostropheCMS deployments, particularly those with publicly queryable documents containing sensitive information, should assess exposure and prioritize verification and remediation.

Why it matters

Defenders should care about CVE-2026-33888 because it allows unauthorized disclosure of sensitive fields on publicly queryable documents in ApostropheCMS versions 4.28.0 and prior. The vulnerability can be exploited trivially by appending query parameters to a public URL with no authentication, potentially exposing internal notes, draft content, or metadata. Defenders responsible for ApostropheCMS deployments should assess exposure, prioritize verification and remediation, and monitor for suspicious activity.

• Disclosure of sensitive fields on publicly queryable documents
• Potential exposure of internal notes, draft content, or metadata
• Verification of affected versions and remediation priority
• Monitoring for suspicious activity on publicly queryable documents

Technical summary

The getRestQuery method of the @apostrophecms/piece-type module in ApostropheCMS versions 4.28.0 and prior does not properly check for a MongoDB projection before applying the admin-configured publicApiProjection. This allows an unauthenticated attacker to disclose any field on publicly queryable documents that the administrator explicitly restricted from the public API. The vulnerability can be exploited trivially by appending query parameters to a public URL with no authentication, potentially exposing internal notes, draft content, or metadata. Defenders should prioritize verifying and upgrading to ApostropheCMS version 4.29.0 or later, and restrict access to sensitive fields and documents.

Defensive priority

Defenders should prioritize verifying and upgrading to ApostropheCMS version 4.29.0 or later, and restrict access to sensitive fields and documents.

Recommended defensive actions

• Verify and upgrade to ApostropheCMS version 4.29.0 or later
• Restrict access to sensitive fields and documents
• Monitor for suspicious activity on publicly queryable documents
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. Defenders should verify the affected versions and assess exposure. The vulnerability allows disclosure of sensitive fields on publicly queryable documents. Verification and remediation are crucial. Official CVE Program record and NVD detail page offer source-specific vulnerability assessment.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.