CVE-2026-110904 Details

An authentication bypass vulnerability has been identified in ApostropheCMS versions prior to 4.33.0, allowing unauthorized access to REST API page reading. The issue arises because the core page REST API can read full page documents that are supposed to be restricted, such as those marked 'private' or 'admin-only'. This is achieved by sending a request to the page API without proper authorization checks, enabling unauthenticated users and low-privilege contributors to access sensitive page content.

To address this vulnerability, remove the '.permission(false)' setting from the 'getOne' and 'all' API handlers. Alternatively, reapply the 'viewRole' checks and the appropriate visibility criteria that are used in the list and autocomplete paths. Ensure that the 'publicApiCheck' only verifies the presence of configuration and add explicit authorization steps for each API verb.