CVE-2026-113653 Details
Description
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, viewRole is not applied to anonymous visitors when a developer exposes user objects through a publicly rendered relationship or expressly enabled public API. Inadequately limited templates, including serialization of an entire related user object, can conditionally disclose user fields, but relationships do not automatically publish full user objects and password hashes are stored separately and are not affected. This issue is fixed in version 4.33.0.
A vulnerability exists in ApostropheCMS versions prior to 4.33.0, where the 'viewRole' permission is not enforced for anonymous users. This issue arises when user objects are exposed through publicly rendered relationships or enabled public APIs. As a result, sensitive user information could be disclosed, particularly if the related user object is serialized in a way that exposes private fields. Although password hashes are stored separately and not impacted by this vulnerability, the flaw could still lead to unauthorized access to user data.
Users can update to ApostropheCMS version 4.33.0 or later, where this vulnerability has been fixed. For projects that rely on the public demo version, an update is also necessary, as it may inadvertently expose user data.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 20, 2026CISA-ADP
Assessed Oct 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ApostropheCMS | < 4.33.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 20, 2026 | New CVE Received | [email protected] |
| Oct 20, 2026 | CVE Modified | CISA-ADP |