CVE-2026-33888

{"id": "CVE-2026-33888", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33888", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-15T20:03:13.844941Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "apostrophecms", "product": "apostrophe", "versions": [{"status": "affected", "version": "< 4.29.0"}]}]}], "published": "2026-04-15T20:16:35.677", "references": [{"url": "https://github.com/apostrophecms/apostrophe/commit/00d472804bb622df36a761b6f2cf2b33b2d4ce80", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/apostrophecms/apostrophe/commit/6c2b548dec2e3f7a82e8e16736603f4cd17525aa", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-xhq9-58fw-859p", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain an authorization bypass vulnerability in the getRestQuery method of the @apostrophecms/piece-type module, where the method checks whether a MongoDB projection has already been set before applying the admin-configured publicApiProjection. An unauthenticated attacker can supply a project query parameter in the REST API request, which is processed by applyBuildersSafely before the permission check, pre-populating the projection state and causing the publicApiProjection to be skipped entirely. This allows disclosure of any field on publicly queryable documents that the administrator explicitly restricted from the public API, such as internal notes, draft content, or metadata. Exploitation is trivial, requiring only appending query parameters to a public URL with no authentication. This issue has been fixed in version 4.29.0."}, {"lang": "es", "value": "ApostropheCMS es un sistema de gesti\u00f3n de contenido Node.js de c\u00f3digo abierto. Las versiones 4.28.0 y anteriores contienen una vulnerabilidad de omisi\u00f3n de autorizaci\u00f3n en el m\u00e9todo getRestQuery del m\u00f3dulo @apostrophecms/piece-type, donde el m\u00e9todo verifica si una proyecci\u00f3n de MongoDB ya ha sido establecida antes de aplicar la publicApiProjection configurada por el administrador. Un atacante no autenticado puede proporcionar un par\u00e1metro de consulta project en la solicitud de la API REST, que es procesado por applyBuildersSafely antes de la verificaci\u00f3n de permisos, pre-poblando el estado de la proyecci\u00f3n y haciendo que la publicApiProjection sea omitida por completo. Esto permite la divulgaci\u00f3n de cualquier campo en documentos consultables p\u00fablicamente que el administrador restringi\u00f3 expl\u00edcitamente de la API p\u00fablica, como notas internas, contenido borrador o metadatos. La explotaci\u00f3n es trivial, requiriendo solo a\u00f1adir par\u00e1metros de consulta a una URL p\u00fablica sin autenticaci\u00f3n. Este problema ha sido solucionado en la versi\u00f3n 4.29.0."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apostrophecms:apostrophecms:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2CFAFBDF-2EB1-404B-B370-8C510FC289AE", "versionEndExcluding": "4.29.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}