ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users

影響: npm:apostrophe < 4.34.0 → 4.34.0

The getOne REST endpoint for pages does not apply viewRole type-level restrictions or viewPermission field-level redaction. An editor-level user who knows a document _id can read the full content of admin-only pages and their privileged fields, while the getAll endpoint correctly enforces both restrictions. Details Finding 3 — viewRole bypass: modules/@apostrophecms/page/index.js exposes getRestQuery(req, omitPermissionCheck = false). The getAll path calls publicApiCheckAsync and thread…

在 GitHub Advisory Database 阅读

2026/10/22 02:15，GitHub Advisory Database 发布了“ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users”（类型：漏洞公告）。严重程度为“中危”（medium）。相关技术：JavaScript / Node.js。CVE：CVE-2026-112957。