ApostropheCMS EUVD-2026-105104

Exploitation requires that the target ApostropheCMS site exposes a piece/page type via a public REST API configured with publicApiProjection, AND that the sensitive field is excluded from that projection yet still defined as searchable or sortable - this specific combination is the prerequisite, not a generic 'misconfiguration'. Limiting factors: the attacker gains only inference via search-membership and sort-ordering oracles, never a direct dump of the hidden field, so values must be guessed/confirmed candidate-by-candidate; the attack is unauthenticated (PR:N) and remote, but yields no integrity or availability impact and only partial confidentiality loss. Sites on 4.34.0 or later, or those whose excluded fields are neither searchable nor sortable, are not exposed.

This is a genuine but low-urgency information-disclosure issue, and the signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3) correctly reflects a network-reachable, low-complexity, unauthenticated weakness with only Low confidentiality impact and no integrity or availability impact - matching the description, which stresses that returned fields stay filtered by the projection and that the flaw enables only targeted inference about hidden values, not an unrestricted field dump. No EPSS score, KEV listing, or POC was supplied in the intelligence set: there is no public exploit identified at time of analysis and no evidence of active exploitation, so the absence of those signals (not a conflict) keeps real-world risk modest. The practical priority is low-to-moderate: the oracle requires an attacker to already know which hidden searchable/sortable field and candidate values to probe, making this most relevant where sensitive data sits in excluded-but-searchable fields of a public API type. Note the dependency on configuration - the issue only exists for a public REST API type using publicApiProjection where the hidden field is searchable or sortable - which the base CVSS score does not capture; verify this deployment condition before treating it as exposed.

An unauthenticated attacker repeatedly queries a public ApostropheCMS REST API endpoint whose type uses publicApiProjection, varying search filters and sort parameters against a field that is excluded from the projection but remains searchable/sortable. By observing which documents appear in results (search membership) and their relative sort order, the attacker infers the hidden field's values for targeted records. No public exploit code is identified at time of analysis; exploitation requires only scripted HTTP requests and knowledge of the target field.