ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a public REST API type that uses publicApiProjection can expose excluded searchable or sortable field information through search membership and sort ordering oracles. Returned fields remain filtered by the projection, so the issue permits targeted inference about hidden values rather than an unrestricted field dump. This issue is fixed in version 4.34.0.

Affected: npm: apostrophe

### Summary ApostropheCMS lets a module expose an anonymous read API by setting `publicApiProjection`, which whitelists the document fields unauthenticated callers may see. The public REST GET handler applies every launderable query builder from the query string *before* forcing that projection. Two of those builders, `search` and `sort`, operate on the underlying documents rather than the projected output, and neither is checked against the projection. An unauthenticated attacker can therefore:

- use `?search=<word>` as a **value oracle** to confirm and locate documents by the content of a field the projection was meant to hide, and - use `?sort[hiddenField]=1` as an **ordering oracle** to rank documents by a hidden field's value.

This is the same confidentiality-bypass class already patched for the `choices`/`counts` builders (gated by `choicesFieldAllowedByProjection`). That gate was never applied to `search` or `sort`.

### Details For an anonymous caller, `getRestQuery` (piece types: `modules/@apostrophecms/piece-type/index.js:1142`; pages: `modules/@apostrophecms/page/index.js`) does:

```js const query = self.find(req).attachments(true); query.applyBuildersSafely(req.query); // (1) apply ALL launderable builders from the query string ... query.project({ ...self.options.publicApiProjection, cacheInvalidatedAt: 1 }); // (2) force read projection query.set('publicApiProjection', self.options.publicApiProjection); // (3) used only by the choices/co…