The vulnerability in ApostropheCMS arises when the REST endpoint that retrieves a single page does not enforce viewRole restrictions or viewPermission field redaction. An editor-level user who knows a page identifier can therefore read the full contents of admin-only pages, including privileged fields. This results in the disclosure of sensitive data that should otherwise be restricted.

The affected product is ApostropheCMS, specifically versions prior to 4.34.0. Any installation running a pre‑4.34.0 release is susceptible if the getOne page API is reachable to users with editor privileges or lower.

The CVSS score of 4.3 indicates a medium severity. Because the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, the likelihood of exploitation appears low at this time. The likely attack vector is a web-based request to the GET /api/v1/@apostrophecms/page/:id endpoint using a known page id, which can be supplied by an authorized user or potentially discovered through enumeration. An attacker who can obtain such an id would be able to retrieve restricted page information.