Is CVE-2026-112957 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-112957?

CVE-2026-112957 has a CVSS v3 severity of MEDIUM (4.3).

Back

CVE-2026-112957

Description

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the getOne REST endpoint for pages does not apply viewRole type-level restrictions or viewPermission field-level redaction. An editor-level user who knows a document _id can read the full content of admin-only pages and their privileged fields, while the getAll endpoint correctly enforces both restrictions. This issue is fixed in version 4.34.0.