CVE-2026-113670: ApostropheCMS: Page REST API authorization bypass
Summary
The core page REST API reads full page documents with .permission(false) in getOne and in the all=1 tree dump, bypassing page-type viewRole, visibility: private, and visibility: loginRequired checks. Unauthenticated visitors and low-privilege contributors can read admin-only and non-public page content by _id/slug.
Details
packages/apostrophe/modules/@apostrophecms/page/index.js:
getOne(L456–465):await self.publicApiCheckAsync(req); ... self.getRestQuery(req).permission(false).and(criteria)— noviewRolethreshold, novisibilityfiltering.allhandler (L318–395):getRestQuery(req).permission(false)(L384–385) walks every page type and returns the projection includingvisibility.publicApiCheckAsync(L3044) only checks thatpublicApiProjectionexists — it performs no authorization.- Correct control behaves differently:
piece-type/index.js:getOne(L319–327) usesgetRestQuery(req)without.permission(false)and enforcesviewRole.
PoC
References
- github.com/advisories/GHSA-2j32-q6rx-h844
- github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce
- github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350
- github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0
- github.com/apostrophecms/apostrophe/security/advisories/GHSA-2j32-q6rx-h844
- nvd.nist.gov/vuln/detail/CVE-2026-113670
Code Behaviors & Features
Detect and mitigate CVE-2026-113670 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →