CVE-2026-112954

MediumCVSS 5.3/10Last modified Oct 23, 2026

Description

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a public REST API type that uses publicApiProjection can expose excluded searchable or sortable field information through search membership and sort ordering oracles. Returned fields remain filtered by the projection, so the issue permits targeted inference about hidden values rather than an unrestricted field dump. This issue is fixed in version 4.34.0.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
apostrophecms	apostrophe	< 4.34.0

References

Timeline

Published: Oct 20, 2026
Last modified: Oct 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1129556.5ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, an authenticated importer can CVE-2026-1129566.5ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, duplicate-import continuation CVE-2026-1129574.3ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the getOne REST endpoint for pages does not apply viewRo CVE-2026-1129585.4ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a project-defined free-form widget style field can carry CVE-2026-112967.5Inappropriate implementation in ImageCapture in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the rende CVE-2026-1129655.5Out-of-bounds read in Windows Management Instrumentation allows an authorized attacker to disclose information locally.CVE-2026-1129667.5Uncontrolled resource consumption in Windows Security Account Manager allows an unauthorized attacker to deny service over a network.CVE-2026-1129679.8Heap-based buffer overflow in Windows Xbox Live Networking Service allows an unauthorized attacker to execute code over a network.CVE-2026-1129687.0Use after free in Windows COM allows an authorized attacker to elevate privileges locally.CVE-2026-1129696.6Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges with a physical attack.CVE-2026-112977.7Insufficient validation of untrusted input in Reader Mode in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to byp CVE-2026-1129707.0Use after free in Windows SMB Client allows an authorized attacker to elevate privileges locally.