CVE-2026-113670 - Vulnerability Details - OpenCVE

This CVE is a duplicate of another CVE.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Apostrophecms	Apostrophecms

No data.

No data.

References

No reference.

History

Wed, 21 Oct 2026 17:15:00 +0000

Type	Values Removed	Values Added
Description	ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the core page REST API reads full page documents with .permission(false) in getOne and in the all=1 tree dump, bypassing page-type viewRole, visibility: private, and visibility: loginRequired checks. Unauthenticated visitors and low-privilege contributors can read admin-only and non-public page content by _id/slug. This issue is fixed in version 4.33.0.	This CVE is a duplicate of another CVE.
Title	ApostropheCMS: Page REST API authorization bypass
Weaknesses	CWE-863
References	https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350 https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0 https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-2j32-q6rx-h844
Metrics	cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}`

Tue, 20 Oct 2026 20:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Apostrophecms Apostrophecms apostrophecms
Vendors & Products		Apostrophecms Apostrophecms apostrophecms

Tue, 20 Oct 2026 17:45:00 +0000

Type	Values Removed	Values Added
Description		ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the core page REST API reads full page documents with .permission(false) in getOne and in the all=1 tree dump, bypassing page-type viewRole, visibility: private, and visibility: loginRequired checks. Unauthenticated visitors and low-privilege contributors can read admin-only and non-public page content by _id/slug. This issue is fixed in version 4.33.0.
Title		ApostropheCMS: Page REST API authorization bypass
Weaknesses		CWE-863
References		https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350 https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0 https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-2j32-q6rx-h844
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}`

MITRE

Status: REJECTED

Assigner: GitHub_M

Published: 2026-10-20T17:37:41.166Z

Updated: 2026-10-21T15:24:37.643Z

Reserved: 2026-10-20T14:27:46.642Z

Link: CVE-2026-113670

Vulnrichment

No data.

NVD

Status : Rejected

Published: 2026-10-20T18:17:20.680

Modified: 2026-10-21T16:17:24.507

Link: CVE-2026-113670

Redhat

No data.