ApostropheCMS CVE-2026-110904

Requires only network access to an ApostropheCMS instance running a version prior to 4.33.0 that exposes the content REST API (the /api/v1/@apostrophecms/page endpoint). Exploitation is demonstrated via the 'all=1' query parameter on the page read endpoint, which returns page documents bypassing the normal authorization/visibility filtering. No authentication, credentials, user interaction, or non-default configuration is required (PR:N/UI:N). Limiting factors: the endpoint must be reachable by the attacker, impact is confined to reading page content (no write/delete), and sites that proxy, disable, or firewall the public REST API, or that have already upgraded to 4.33.0+, are not exposed.

This is a genuine but moderate-priority issue. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote, unauthenticated, low-complexity exploitation, which is the main driver of the 5.3 (MEDIUM) score. However, impact is deliberately narrow: C:L with I:N/A:N means an attacker can only read page data that should be access-controlled - no modification, no availability loss, no full data disclosure. No EPSS score was supplied in the input, so exploitation probability cannot be quantified. The CVE is NOT in CISA KEV and no public exploit code is referenced, so there is no evidence of active exploitation or weaponization. The result is a low-friction-but-low-impact flaw: trivially triggerable (a single documented GET request) yet limited to unauthorized reading of page content. Prioritize patching for any internet-facing ApostropheCMS instance that stores sensitive or unpublished content, but this is not a 'drop everything' vulnerability compared to RCE or privilege-escalation classes. Note the single conflicting-signal caveat: the tag labels this 'Authentication Bypass' while the CWE is CWE-863 (Incorrect Authorization) - the real weakness is broken authorization on the REST read endpoint rather than a credential/session bypass; treat descriptions accordingly.

An unauthenticated attacker sends a crafted REST API request such as GET /api/v1/@apostrophecms/page?all=1 to a public ApostropheCMS site before version 4.33.0, causing the server to return page documents that should have been restricted (e.g., unpublished, draft, or permission-gated pages). No public exploit code is referenced in the input, but the attack is trivial given the vulnerability is demonstrated directly in the advisory description. Because attack complexity is low and no authentication or user interaction is needed, exploitation requires only HTTP access to the target.