## ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users

- 種別: advisory
- 重大度: medium
- 関連技術: nodejs
- CVE: CVE-2026-112957
- 公開日時: 2026-10-21T17:15:21.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-vh56-5m88-39rq)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-vh56-5m88-39rq

影響: npm:apostrophe < 4.34.0 → 4.34.0
Summary The getOne REST endpoint for pages does not apply viewRole type-level restrictions or viewPermission field-level redaction. An editor-level user who knows a document _id can read the full content of admin-only pages and their privileged fields, while the getAll endpoint correctly enforces both restrictions. Details Finding 3 — viewRole bypass: modules/@apostrophecms/page/index.js exposes getRestQuery(req, omitPermissionCheck = false). The getAll path calls publicApiCheckAsync and thread…