CVE-2026-113670 Details
Description
Rejected reason: This CVE is a duplicate of another CVE.
A vulnerability in ApostropheCMS's core page REST API prior to version 4.33.0 allows unauthenticated users and low-privilege contributors to bypass visibility checks and read private or admin-only page content. This is achieved by accessing pages through their ID or slug, exploiting the API's failure to enforce proper authorization roles and visibility requirements. The issue arises because the API can be queried without authentication, and certain page types are exempt from visibility restrictions, leading to unauthorized access to sensitive content.
Users can update to ApostropheCMS version 4.33.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No CVSS 3.x data is available for this CVE.
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
No references are available for this CVE.
Weakness Enumeration
No weakness enumeration is available for this CVE.
Affected Products
No affected product data is available for this CVE.
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 21, 2026 | CVE Rejected | [email protected] |
| Oct 21, 2026 | CVE Modified | [email protected] |
| Oct 21, 2026 | CVE Modified | CVE |
| Oct 20, 2026 | New CVE Received | [email protected] |