Information disclosure in Apostrophecms Apostrophe
CVE-2026-39857
ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain an authorization bypass vulnerability in the choices and counts query parameters of the REST API, where these query builders execute MongoDB distinct() operations that bypass the publicApiProjection restrictions intended to limit which fields are exposed publicly. The choices and counts parameters are processed via applyBuildersSafely before the projection is applied, and MongoDB's distinct operation does not respect projections, returning all distinct values directly. The results are returned in the API response without any filtering against publicApiProjection or removeForbiddenFields. An unauthenticated attacker can extract all distinct field values for any schema field type that has a registered query builder, including string, integer, float, select, boolean, date, slug, and relationship fields. Fields protected with viewPermission are similarly exposed, and the counts variant additionally reveals how many documents have each distinct value. Both the piece-type and page REST APIs are affected. This issue has been fixed in version 4.29.0.
Vulnerability class: Information Disclosure
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
EPSS exploit prediction
EPSS: 0.004 (29.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 30th percentile — 29.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: -0.001
Affected products
- Apostrophecms Apostrophe — versions < 4.29.0
- Apostrophecms
Weakness classification (CWE)
References
- github.com/apostrophecms/apostrophe/security/advisories/GHSA-c276-fj82-f2pq (Exploit, Mitigation, Vendor Advisory)
- github.com/apostrophecms/apostrophe/commit/6c2b548dec2e3f7a82e8e16736603f4cd175… (Patch)
Frequently asked questions
- What is CVE-2026-39857?
- CVE-2026-39857 is a medium-severity vulnerability in Apostrophecms Apostrophe, classified under Information Disclosure. CVSS score: 5.3/10. Published 2026-04-15.
- How severe is CVE-2026-39857?
- Medium severity. CVSS v3 base score is 5.3 out of 10.