The vulnerability arises when ApostropheCMS does not apply the viewRole setting to anonymous visitors; as a result, if a developer exposes @apostrophecms/user objects through a publicly rendered relationship or an explicitly enabled public API, inadequate templates may serialize entire related user objects. This can lead to the discovery of user fields to unauthenticated users, while password hashes remain protected. The primary effect is the disclosure of potentially sensitive user information via a missing authorization control (CWE‑863).

ApostropheCMS installations running any version earlier than 4.33.0 are susceptible. All such deployments that expose user relations or public APIs are affected, regardless of the site’s specific configuration.

The CVSS score of 6.9 indicates a moderate severity, and the vulnerability is not listed in the CISA KEV catalog. Because the exploit does not require authentication and relies only on publicly accessible endpoints, an attacker can simply query a site that renders a user relationship or has a public API enabled; no additional preconditions exist. The attack vector is therefore likely a straightforward web request to the exposed relationship or API endpoint.