ApostropheCMS versions prior to 4.33.0 contain an authorization weakness that allows an attacker to bypass authentication when requesting page data through the REST API, as shown by accessing the endpoint /api/v1/@apostrophecms/page?all=1. This flaw enables unauthenticated reading of all page content, potentially exposing confidential information and undermining the integrity of the content management system. The issue is classified as CWE-863, an authorization bypass using shared resources.

The vulnerability affects the ApostropheCMS product from the ApostropheCMS vendor. Any installation running a version earlier than 4.33.0 is susceptible. No specific build numbers beyond that boundary are identified.

The CVSS score of 5.3 indicates a moderate severity. Because no EPSS data is available, the likelihood of exploitation is unknown, but the vulnerability can be triggered by a straightforward HTTP request to the exposed API endpoint, which an attacker can perform from any network location. This attacker does not need valid credentials or elevated privileges, making the attack vector likely to be any external host capable of reaching the API.