{"id":"ghsa-ghsa-vh56-5m88-39rq","seq":32729,"kind":"advisory","title":"ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users","url":"https://github.com/advisories/GHSA-vh56-5m88-39rq","permalink":"https://vulnpulse.app/items/ghsa-ghsa-vh56-5m88-39rq","summary":"影響: npm:apostrophe < 4.34.0 → 4.34.0\nSummary The getOne REST endpoint for pages does not apply viewRole type-level restrictions or viewPermission field-level redaction. An editor-level user who knows a document _id can read the full content of admin-only pages and their privileged fields, while the getAll endpoint correctly enforces both restrictions. Details Finding 3 — viewRole bypass: modules/@apostrophecms/page/index.js exposes getRestQuery(req, omitPermissionCheck = false). The getAll path calls publicApiCheckAsync and thread…","severity":"medium","techs":["nodejs"],"cves":["CVE-2026-112957"],"tags":["GHSA-vh56-5m88-39rq","apostrophe"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-21T17:15:21.000Z","fetched_at":"2026-10-21T18:28:52.985Z"}