ApostropheCMS CVE-2026-39857

The target must have a piece-type or page REST API endpoint with a non-empty publicApiProjection configuration, creating the disparity that the distinct() bypass exploits. No authentication is required; the attacker simply needs network access to the API and knowledge of a schema field name not included in the projection. Fields protected by viewPermission are also exposed if they possess a registered query builder, which all standard field types do.

CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) indicates medium severity with low confidentiality impact, no authentication required, and a network attack vector. The EPSS score of 0.04% suggests very low exploitation probability. SSVC assessment (exploitation: PoC, automatable: yes, technical impact: partial) confirms an available proof-of-concept but no active exploitation in the wild, and the impact is limited to information disclosure without escalation. While automatable and unauthenticated, the real-world risk is moderate given the narrow impact and low EPSS probability. No conflicting data is present; all sources align.

An unauthenticated attacker sends a crafted GET request to the public REST API endpoint (e.g., /api/v1/thing?choices=secretField) where secretField is not listed in the publicApiProjection. The server processes the distinct() query, bypasses projection enforcement, and returns all distinct values of that field in the response, disclosing sensitive schema data.