Executive brief
ApostropheCMS, a popular content management system, contains a flaw in how it handles public data requests. An unauthenticated attacker can bypass security settings that are supposed to hide sensitive database fields, potentially exposing internal notes, metadata, or draft content. This could lead to the unauthorized disclosure of private information that site administrators intended to keep hidden from the public.
Technical details
The vulnerability exists in the `getRestQuery` method of the `@apostrophecms/piece-type` module. The method checks if a MongoDB projection is already set (`!query.state.project`) before applying the security-enforced `publicApiProjection`. Because user-supplied query parameters are processed via `applyBuildersSafely` before this check, an attacker can provide a `project` parameter in the REST API request to pre-populate the projection state. This causes the application to skip the intended security restrictions, allowing the attacker to request and receive any field on publicly queryable documents. The issue is fixed in version 4.29.0 by removing the conditional check and unconditionally applying the projection.
Affected products
- ApostropheCMS apostrophe < 4.29.0
Timeline
- 2026-04-15: disclosed
- 2026-04-15: patched: Fixed in version 4.29.0
- 2026-04-16: advisory