CVE-2026-110904CVE-2026-113670GHSA-2j32-q6rx-h844
ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated by a /api/v1/@apostrophecms/page?all=1 call.
apostrophecms ApostropheCMSnpmLibraries & packages
CVSS
5.3MediumExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 15 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.25%Chance of exploitation activity in the next 30 days, higher than 15% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Affected versions 2
- ApostropheCMSaffected: all versions before 4.33.0CVE List
- apostrophe, npmfrom first release, fixed in 4.33.0OSV