Vulnerabilities

ApostropheCMS is an open-source Node.js content management system.

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the getOne REST endpoint for pages does not apply viewRole type-level restrictions or viewPermission field-level redaction. An editor-level user who knows a document _id can read the full content of admin-only pages and their privileged fields, while the getAll endpoint correctly enforces both restrictions. This issue is fixed in version 4.34.0.

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

Node.js

Product

Node.js

CVSS

4.3

Fix

available

Exposure class

Developer platform

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-112957 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 20
   CVE NVD 11d ago

   ApostropheCMS is an open-source Node.js content management system.

   CVSS 7.5 Fix available CVE-2026-113711 Node.js
2. 13
   CVE NVD 11d ago

   ApostropheCMS is an open-source Node.js content management system.

   CVSS 5.9 Fix available CVE-2026-113710 Node.js
3. 8
   CVE NVD 11d ago

   ApostropheCMS is an open-source Node.js content management system.

   CVSS 4.3 CVE-2026-113671 Node.js
4. 13
   CVE NVD 11d ago

   ApostropheCMS is an open-source Node.js content management system.

   CVSS 5.3 Fix available CVE-2026-113670 Node.js
5. 10
   CVE NVD 11d ago

   ApostropheCMS is an open-source Node.js content management system.

   Fix available CVE-2026-113669 Node.js
6. 13
   CVE NVD 11d ago

   ApostropheCMS is an open-source Node.js content management system.

   CVSS 5.3 Fix available CVE-2026-113668 Node.js
7. 10
   CVE NVD 11d ago

   ApostropheCMS is an open-source Node.js content management system.

   Fix available CVE-2026-113667 Node.js
8. 15
   CVE NVD 11d ago

   ApostropheCMS is an open-source Node.js content management system.

   CVSS 7.1 CVE-2026-113666 Node.js
9. 10
   CVE NVD 11d ago

   ApostropheCMS is an open-source Node.js content management system.

   CVSS 3.7 Fix available CVE-2026-113665 Node.js MongoDB
10. 10
    CVE NVD 11d ago

    ApostropheCMS is an open-source Node.js content management system.

    Fix available CVE-2026-113664 Node.js
11. 13
    CVE NVD 11d ago

    ApostropheCMS is an open-source Node.js content management system.

    CVSS 5.4 Fix available CVE-2026-113662 Node.js
12. 13
    CVE NVD 11d ago

    ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API.

    CVSS 5.4 Fix available CVE-2026-113661 Node.js
13. 13
    CVE NVD 11d ago

    ApostropheCMS is an open-source Node.js content management system.

    CVSS 4.3 Fix available CVE-2026-113660 Node.js
14. 13
    CVE NVD 11d ago

    ApostropheCMS is an open-source Node.js content management system.

    CVSS 6.1 Fix available CVE-2026-113659 Node.js
15. 20
    CVE NVD 11d ago

    ApostropheCMS is an open-source Node.js content management system.

    CVSS 7.5 Fix available CVE-2026-113658 Node.js
16. 5
    CVE NVD 11d ago

    ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API.

    CVSS 3.7 CVE-2026-113657 Node.js
17. 13
    CVE NVD 11d ago

    ApostropheCMS is an open-source Node.js content management system.

    CVSS 5.3 Fix available CVE-2026-113656 Node.js
18. 13
    CVE NVD 11d ago

    ApostropheCMS is an open-source Node.js content management system.

    CVSS 4.3 Fix available CVE-2026-113655 Node.js
19. 5
    CVE NVD 11d ago

    ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API.

    CVE-2026-113654 Node.js
20. 10
    CVE NVD 11d ago

    ApostropheCMS is an open-source Node.js content management system.

    Fix available CVE-2026-113653 Node.js