https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 22 Oct 2026 23:00:16 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-112957 <p>ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the getOne REST endpoint for pages does not apply viewRole type-level restrictions or viewPermission field-level redaction. An editor-level user who knows a document _id can read the full content of admin-only pages and their privileged fields, while the getAll endpoint correctly enforces both restrictions. This issue is fixed in version 4.34.0.</p> <p>ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the getOne REST endpoint for pages does not apply viewRole type-level restrictions or viewPermission field-level redaction. An editor-level user who knows a document _id can read the full content of admin-only pages and their privileged fields, while the getAll endpoint correctly enforces both restrictions. This issue is fixed in version 4.34.0.</p> https://db.gcve.eu/vuln/fkie_cve-2026-112957 https://db.gcve.eu/vuln/ghsa-vh56-5m88-39rq <p><strong>Affected:</strong> npm: apostrophe</p> <p>### Summary The `getOne` REST endpoint for pages does not apply `viewRole` type-level restrictions or `viewPermission` field-level redaction. An editor-level user who knows a document `_id` can read the full content of admin-only pages and their privileged fields, while the `getAll` endpoint correctly enforces both restrictions.</p> <p>### Details **Finding 3 — viewRole bypass:** `modules/@apostrophecms/page/index.js` exposes `getRestQuery(req, omitPermissionCheck = false)`. The `getAll` path calls `publicApiCheckAsync` and threads the full query builder pipeline including `viewRole` filtering. The `getOne` path uses a divergent code path that skips this pipeline.</p> <p>A page type declared with `viewRole: &#39;admin&#39;` is inaccessible via `GET /api/v1/@apostrophecms/page?type=secretPage` (returns 403 to an editor) but is fully returned by `GET /api/v1/@apostrophecms/page/:id:en:published` to the same editor.</p> <p>**Finding 4 — viewPermission field leak:** Fields decorated with `viewPermission: { action: &#39;edit&#39;, type: &#39;@apostrophecms/page&#39; }` are stripped by `removeForbiddenFields` in the `getAll` path but are returned verbatim in `getOne`. An editor who knows any document `_id` can read all `viewPermission`-restricted fields.</p> <p>### PoC ```bash # Log in as editor, get session jar EDITOR_JAR=&#34;...&#34;</p> <p># getAll — correctly blocked curl -b &#34;$EDITOR_JAR&#34; \ &#34;http://TARGET/api/v1/@apostrophecms/page?type=secretPage&#34; # → 403 Forbidden</p> <p># getOne — bypassed, returns full document including viewPermission…</p> <p><strong>Affected:</strong> npm: apostrophe</p> <p>### Summary The `getOne` REST endpoint for pages does not apply `viewRole` type-level restrictions or `viewPermission` field-level redaction. An editor-level user who knows a document `_id` can read the full content of admin-only pages and their privileged fields, while the `getAll` endpoint correctly enforces both restrictions.</p> <p>### Details **Finding 3 — viewRole bypass:** `modules/@apostrophecms/page/index.js` exposes `getRestQuery(req, omitPermissionCheck = false)`. The `getAll` path calls `publicApiCheckAsync` and threads the full query builder pipeline including `viewRole` filtering. The `getOne` path uses a divergent code path that skips this pipeline.</p> <p>A page type declared with `viewRole: &#39;admin&#39;` is inaccessible via `GET /api/v1/@apostrophecms/page?type=secretPage` (returns 403 to an editor) but is fully returned by `GET /api/v1/@apostrophecms/page/:id:en:published` to the same editor.</p> <p>**Finding 4 — viewPermission field leak:** Fields decorated with `viewPermission: { action: &#39;edit&#39;, type: &#39;@apostrophecms/page&#39; }` are stripped by `removeForbiddenFields` in the `getAll` path but are returned verbatim in `getOne`. An editor who knows any document `_id` can read all `viewPermission`-restricted fields.</p> <p>### PoC ```bash # Log in as editor, get session jar EDITOR_JAR=&#34;...&#34;</p> <p># getAll — correctly blocked curl -b &#34;$EDITOR_JAR&#34; \ &#34;http://TARGET/api/v1/@apostrophecms/page?type=secretPage&#34; # → 403 Forbidden</p> <p># getOne — bypassed, returns full document including viewPermission…</p> https://db.gcve.eu/vuln/ghsa-vh56-5m88-39rq