CVE-2026-113670: CWE-863: Incorrect Authorization in apostrophecms apostrophe

CVE-2026-113670 describes an incorrect authorization vulnerability (CWE-863) in ApostropheCMS, an open-source Node.js content management system. Before version 4.33.0, the core page REST API's getOne method and the all=1 tree dump read full page documents with .permission(false), which bypasses page-type viewRole and visibility restrictions such as private and loginRequired. Consequently, unauthenticated visitors and low-privilege contributors can read content intended only for admins or non-public audiences by querying pages via _id or slug. This vulnerability allows unauthorized information disclosure. The issue is fixed in ApostropheCMS version 4.33.0.

The vulnerability allows unauthorized disclosure of admin-only and non-public page content to unauthenticated visitors and low-privilege contributors. This can lead to exposure of sensitive information that should be restricted by page-type viewRole and visibility settings. There is no indication of integrity or availability impact. The CVSS 3.1 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, and confidentiality impact only.

Upgrade ApostropheCMS to version 4.33.0 or later, where this authorization bypass issue is fixed. No other mitigation or temporary workaround is indicated. Since this is not a cloud service, users must apply the update themselves.