ApostropheCMS versions 4.28.0 and earlier suffer an authorization bypass in the getRestQuery method of the @apostrophecms/piece-type module. The bug allows an unauthenticated attacker to supply a project query parameter that is processed before the system’s publicApiProjection check, effectively disabling the admin‑configured projection safeguards. This flaw enables disclosure of fields that administrators have explicitly withheld from the public API, such as internal notes, draft content, or metadata. The weakness is a classic informational disclosure (CWE‑200) compounded by improper authorization checks (CWE‑863). Exploitation is trivial, requiring only an appended query string to a publicly reachable URL.

ApostropheCMS, open‑source Node.js content‑management system, is affected. All releases up to and including 4.28.0 are vulnerable. The vulnerability was resolved in the 4.29.0 release. No specific edition or platform information is provided beyond the generic product name.

The CVSS score of 5.3 denotes a moderate severity, with the vulnerability enabling non‑authenticated data exposure. EPSS scoring is not available, so the empirical exploitation probability cannot be quantified from the data. The vulnerability is not listed in the CISA KEV catalog, indicating no confirmed widespread exploitation reports. The likely attack vector is through any endpoint that accepts a project query parameter in the public REST API, as inferred from the description of the flaw. An attacker can construct a request that includes the project parameter, causing the system to skip the publicApiProjection and return private fields to an unauthenticated client.