ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API
影響: npm:apostrophe < 4.34.0 → 4.34.0
ApostropheCMS lets a module expose an anonymous read API by setting publicApiProjection, which whitelists the document fields unauthenticated callers may see. The public REST GET handler applies every launderable query builder from the query string before forcing that projection. Two of those builders, search and sort, operate on the underlying documents rather than the projected output, and neither is checked against the projection. An unauthenticated attacker can therefore: - use ?sea…
| CVE | CVE-2026-112954 |
|---|---|
| 정보원 | GitHub Advisory Database |
| 수집 시각 | 2026. 10. 22. 오전 03:28 |
| 데이터 | Markdown JSON |
2026. 10. 22. 오전 02:12, GitHub Advisory Database에서 "ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: JavaScript / Node.js. CVE: CVE-2026-112954.