Is CVE-2026-113670 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-113670 being exploited in the wild.

How severe is CVE-2026-113670?

Medium severity, with a CVSS score of 5.3, published 15 October 2026.

Which products and versions are affected?

ApostropheCMS Apostrophe before 4.33.0; apostrophe (npm) SEMVER:introduced=0,fixed=4.33.0.

Is there a fix for CVE-2026-113670?

Yes. apostrophe (npm): upgrade to 4.33.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-113670 attacked?

It is attacked over the network.

Am I affected by CVE-2026-113670?

Check whether you run ApostropheCMS Apostrophe or apostrophe (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-113670: ApostropheCMS REST API page authorization bypass

CVE-2026-113670 · Severity: medium · CVSS 5.3 · Published 2026-10-15

ApostropheCMS is a headless CMS that manages website content and user permissions. An authentication bypass vulnerability in its REST API allows unauthenticated attackers to read private and admin-only pages that should be restricted, and contributors can access protected fields they should not see. Attackers can enumerate the entire site structure including visibility and type metadata.

Technologies: ApostropheCMS Apostrophe, apostrophe (npm). Vendors: ApostropheCMS, npm.

Quick answers

Is CVE-2026-113670 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-113670 being exploited in the wild.
How severe is CVE-2026-113670?: Medium severity, with a CVSS score of 5.3, published 15 October 2026.
Which products and versions are affected?: ApostropheCMS Apostrophe before 4.33.0; apostrophe (npm) SEMVER:introduced=0,fixed=4.33.0.
Is there a fix for CVE-2026-113670?: Yes. apostrophe (npm): upgrade to 4.33.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-113670 attacked?: It is attacked over the network.
Am I affected by CVE-2026-113670?: Check whether you run ApostropheCMS Apostrophe or apostrophe (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

apostrophe (npm): upgrade to 4.33.0 or later
```
npm install apostrophe@4.33.0
```

Technical details

The page REST API's getOne and all=1 endpoints use .permission(false) to disable authorization checks, bypassing viewRole thresholds and visibility filtering (private, loginRequired). The publicApiCheckAsync function only verifies that publicApiProjection exists without enforcing authorization. An unauthenticated attacker can directly request any page by ID/slug, and the all=1 parameter returns the full site tree with sensitive metadata.

Affected products

ApostropheCMS Apostrophe before 4.33.0

Identifiers

CVE-2026-113670
CVE-2026-110904
GHSA-2j32-q6rx-h844

Timeline

2026-10-02: disclosed

References

https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-2j32-q6rx-h844

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.