CVE-2026-112954 ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-112954?
CVE-2026-112954 is a medium-severity vulnerability in apostrophecms apostrophe, published on 20 Oct 2026.
Official description
ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a public REST API type that uses publicApiProjection can expose excluded searchable or sortable field information through search membership and sort ordering oracles. Returned fields remain filtered by the projection, so the issue permits targeted inference about hidden values rather than an unrestricted field dump. This issue is fixed in version 4.34.0.
Weakness: CWE-200
Which versions are affected by CVE-2026-112954?
2 open source packages ship an affected version, including apostrophe.
| Package | Affected | Fixed in |
|---|---|---|
apostrophe npm | All versions | 4.34.0 |
apostrophe npm | All versions | 4.34.0 |
How do I fix CVE-2026-112954?
Upgrade apostrophe to 4.34.0 or later.
Is CVE-2026-112954 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-112954 exists.
Sources
Also known as GHSA-rqgm-cfrp-4hx8.