CVE-2026-39857 is an information exposure vulnerability in ApostropheCMS (Node.js CMS) versions prior to 4.29.0. The vulnerability occurs in the choices and counts query parameters of the REST API, which use MongoDB distinct() operations that bypass publicApiProjection restrictions designed to limit publicly exposed fields. Because distinct() ignores projections, the API returns all distinct values for any schema field with a registered query builder, including fields protected by viewPermission. This allows unauthenticated attackers to extract sensitive field values and counts of documents with those values. The flaw affects both piece-type and page REST APIs and was fixed in version 4.29.0.

An unauthenticated attacker can access sensitive information from ApostropheCMS instances running versions 4.28.0 and earlier by exploiting the REST API. The attacker can retrieve distinct values of various schema fields, including those protected by view permissions, potentially exposing confidential data. The counts parameter additionally reveals how many documents contain each distinct value. This exposure does not affect data integrity or availability but compromises confidentiality.

This vulnerability has been fixed in ApostropheCMS version 4.29.0. Users should upgrade to version 4.29.0 or later to remediate this issue. No official patch or temporary fix is documented beyond upgrading. Since this is not a cloud service, remediation depends on applying the vendor's fixed version.