CVE-2026-39857: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in apostrophecms apostrophe
ApostropheCMS versions 4. 28. 0 and earlier have an authorization bypass vulnerability in the REST API's choices and counts query parameters. This flaw allows unauthenticated attackers to retrieve distinct values of any schema field, including those protected by view permissions, bypassing intended public field restrictions. The vulnerability arises because MongoDB's distinct() operation does not respect field projections, leading to exposure of sensitive information. The issue affects both piece-type and page REST APIs and has been fixed in version 4. 29. 0.
AI Analysis
Technical Summary
CVE-2026-39857 describes an authorization bypass vulnerability in ApostropheCMS (versions ≤ 4.28.0) where the choices and counts query parameters in the REST API execute MongoDB distinct() operations that ignore publicApiProjection restrictions. Because distinct() returns all distinct values without filtering, unauthenticated attackers can extract sensitive field values, including those protected by viewPermission. This affects multiple field types and exposes data without authentication. The vulnerability impacts both piece-type and page REST APIs and was resolved in version 4.29.0.
Potential Impact
An unauthenticated attacker can access sensitive information by retrieving distinct values of any schema field type, including fields protected by view permissions. This exposure can reveal confidential data fields and document counts associated with those values. The vulnerability does not allow modification or deletion of data but compromises confidentiality.
Mitigation Recommendations
This vulnerability is fixed in ApostropheCMS version 4.29.0. Users should upgrade to version 4.29.0 or later to remediate this issue. No official patch or temporary fix is documented beyond upgrading. Until upgraded, restrict access to the affected REST APIs if possible.
CVE-2026-39857: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in apostrophecms apostrophe
Description
ApostropheCMS versions 4. 28. 0 and earlier have an authorization bypass vulnerability in the REST API's choices and counts query parameters. This flaw allows unauthenticated attackers to retrieve distinct values of any schema field, including those protected by view permissions, bypassing intended public field restrictions. The vulnerability arises because MongoDB's distinct() operation does not respect field projections, leading to exposure of sensitive information. The issue affects both piece-type and page REST APIs and has been fixed in version 4. 29. 0.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-39857 describes an authorization bypass vulnerability in ApostropheCMS (versions ≤ 4.28.0) where the choices and counts query parameters in the REST API execute MongoDB distinct() operations that ignore publicApiProjection restrictions. Because distinct() returns all distinct values without filtering, unauthenticated attackers can extract sensitive field values, including those protected by viewPermission. This affects multiple field types and exposes data without authentication. The vulnerability impacts both piece-type and page REST APIs and was resolved in version 4.29.0.
Potential Impact
An unauthenticated attacker can access sensitive information by retrieving distinct values of any schema field type, including fields protected by view permissions. This exposure can reveal confidential data fields and document counts associated with those values. The vulnerability does not allow modification or deletion of data but compromises confidentiality.
Mitigation Recommendations
This vulnerability is fixed in ApostropheCMS version 4.29.0. Users should upgrade to version 4.29.0 or later to remediate this issue. No official patch or temporary fix is documented beyond upgrading. Until upgraded, restrict access to the affected REST APIs if possible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-07T19:13:20.379Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69dfeeb382d89c981f942281
Added to database: 4/15/2026, 8:01:55 PM
Last enriched: 4/15/2026, 8:16:57 PM
Last updated: 4/15/2026, 10:08:07 PM
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.