ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a public REST API type that uses publicApiProjection can expose excluded searchable or sortable field information through search membership and sort ordering oracles. Returned fields remain filtered by the projection, so the issue permits targeted inference about hidden values rather than an unrestricted field dump. This issue is fixed in version 4.34.0.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 3
- StatusPublished → DeferredNVD modified 2026-10-20 19:53
- StatusReceived → PublishedNVD modified 2026-10-20 15:51
- First seenCVSS 5.3NVD modified 2026-10-20 16:17
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 5
- https://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498
- https://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea
- https://github.com/apostrophecms/apostrophe/releases/tag/[email protected]
- https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-rqgm-cfrp-4hx8
- https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-rqgm-cfrp-4hx8