CVE-2026-33888 is an authorization bypass vulnerability in ApostropheCMS (Node.js CMS) versions prior to 4.29.0. The vulnerability exists in the getRestQuery method where the system checks if a MongoDB projection is set before applying the admin-configured publicApiProjection. An attacker can supply a crafted project query parameter in a REST API request, which is processed before the permission check, causing the publicApiProjection to be skipped. This allows disclosure of any fields that administrators intended to restrict from public API access, such as internal notes or draft content. Exploitation requires no authentication and is trivial by appending query parameters to public URLs. The vulnerability is tracked under CWE-863 (Incorrect Authorization) and CWE-200 (Information Exposure).

An unauthenticated attacker can bypass authorization controls to access restricted fields in publicly queryable documents via the REST API. This leads to unauthorized disclosure of sensitive information such as internal notes, draft content, or metadata that administrators intended to keep private. There is no impact on integrity or availability reported.

This vulnerability is fixed in ApostropheCMS version 4.29.0. Users should upgrade to version 4.29.0 or later to remediate this issue. Since this is not a cloud service, patching the affected software is required. Patch status is confirmed by the vendor's versioning information. No additional mitigations are indicated.