ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged usersGHSA-vh56-5m88-39rq
MEDIUMFix: apostrophecms/apostrophe@06e4b37GHSA-vh56-5m88-39rq is a medium-severity (CVSS 4.3) CWE-862 vulnerability in apostrophe. A fix is available for apostrophe — see the affected versions and patch details below.
Exploitation Status
No confirmed exploitation observed yet
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for GHSA-vh56-5m88-39rq.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
GHSA-vh56-5m88-39rq by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 394,803 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
apostrophenpmDescription
Summary
The getOne REST endpoint for pages does not apply viewRole type-level restrictions
or viewPermission field-level redaction. An editor-level user who knows a document
_id can read the full content of admin-only pages and their privileged fields, while
the getAll endpoint correctly enforces both restrictions.
Details
Finding 3 — viewRole bypass:
modules/@apostrophecms/page/index.js exposes getRestQuery(req, omitPermissionCheck = false). The getAll path calls publicApiCheckAsync and threads the full query builder
pipeline including viewRole filtering. The getOne path uses a divergent code path
that skips this pipeline.
A page type declared with viewRole: 'admin' is inaccessible via GET /api/v1/@apostrophecms/page?type=secretPage (returns 403 to an editor) but is fully
returned by GET /api/v1/@apostrophecms/page/:id:en:published to the same editor.
Finding 4 — viewPermission field leak:
Fields decorated with viewPermission: { action: 'edit', type: '@apostrophecms/page' }
are stripped by removeForbiddenFields in the getAll path but are returned verbatim
in getOne. An editor who knows any document _id can read all
viewPermission-restricted fields.
PoC
# Log in as editor, get session jar
EDITOR_JAR="..."
# getAll — correctly blocked
curl -b "$EDITOR_JAR" \
"http://TARGET/api/v1/@apostrophecms/page?type=secretPage"
# → 403 Forbidden
# getOne — bypassed, returns full document including viewPermission fields
curl -b "$EDITOR_JAR" \
"http://TARGET/api/v1/@apostrophecms/page/ADMIN_PAGE_ID:en:published"
# → 200 OK, full doc including secretField value
Impact
Editors can read the full content of any page — including those restricted to admins via
viewRole — if they know or can guess the _id. Sensitive field values gated by
viewPermission are also fully exposed. This breaks the content access control model
for any site using these decorators.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | apostrophe | all versions | 4.34.0npm install apostrophe@4.34.0 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for apostrophe, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update apostrophe to 4.34.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-vh56-5m88-39rq is resolved across your whole dependency graph.
Workarounds
Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.
Frequently Asked Questions
Is GHSA-vh56-5m88-39rq in your dependencies?
Find it across npm, including transitive dependencies.