ApostropheCMS before version 4.34.0 exposes hidden searchable or sortable fields through the public REST API’s publicApiProjection. An unauthenticated attacker can use search and sort queries to infer values that should remain hidden, although the returned payload is still filtered by the projection. This is an information‑exposure flaw classified as CWE‑200.

All installations of ApostropheCMS using the apostrophe project older than 4.34.0 are affected. The supply‑chain fix is in release 4.34.0. There is no indication of affected patch level within the product itself beyond the major release number.

The vulnerability carries a CVSS score of 5.3, indicating moderate impact. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers may exploit the public REST API to run unauthenticated queries that act as oracles, thereby gaining insight into otherwise protected data. Because the API is publicly reachable, the threat surface is sufficiently large for a determined attacker to leverage this information in a broader compromise context.