CVE-2026-33888: 
JavaScript vulnerability analysis and mitigation

CVE-2026-33888 is an authorization bypass vulnerability in ApostropheCMS, an open-source Node.js content management system, that allows unauthenticated attackers to bypass administrator-configured field restrictions on the piece-type REST API. The flaw exists in versions 4.28.0 and prior of the @apostrophecms/piece-type module and was publicly disclosed on April 15, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory).

The root cause (CWE-863: Incorrect Authorization; CWE-200: Exposure of Sensitive Information) lies in the getRestQuery method of modules/@apostrophecms/piece-type/index.js. The method calls applyBuildersSafely(req.query) to process all user-supplied query parameters — including the project builder — before checking whether the caller is authenticated. The project builder sanitizes the user-supplied projection to booleans and stores it in query.state.project. The subsequent permission check then evaluates !query.state.project to decide whether to apply the admin-configured publicApiProjection; because the attacker has already pre-populated query.state.project, this condition is false and the security projection is skipped entirely. By contrast, the equivalent @apostrophecms/page module applies publicApiProjection unconditionally, making only the piece-type module vulnerable. No authentication, chaining, or special tooling is required — exploitation is as simple as appending ?project[field]=1 to a public API URL (GitHub Advisory, Patch Commit).

Successful exploitation allows an unauthenticated remote attacker to read any field on documents that are already publicly queryable, bypassing the field-level restrictions the site administrator explicitly configured via publicApiProjection. Exposed data may include internal notes, draft content, metadata, creation/update timestamps, slugs, visibility flags, and other sensitive fields. Document-level access controls remain intact — attackers cannot access documents they would not otherwise be permitted to query — but the confidentiality of restricted fields on accessible documents is fully compromised. There is no integrity or availability impact (GitHub Advisory).

A proof-of-concept exploit consisting of concrete curl commands is publicly available in the GitHub Security Advisory and has been assessed with high confidence as a real, working exploit (GitHub Advisory). No authentication or special privileges are required, and exploitation requires only appending query parameters to a public URL. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.088%, reflecting low but non-zero probability of exploitation in the near term (Feedly).

1. Reconnaissance: Identify ApostropheCMS instances running version 4.28.0 or earlier. Look for publicly accessible REST API endpoints at paths such as /api/v1/<piece-type> (e.g., /api/v1/article).
2. Baseline request: Send a normal unauthenticated GET request to confirm the API is accessible and observe which fields are returned under the configured publicApiProjection:

   curl 'http://target.example.com/api/v1/article'

   Note that only fields allowed by the admin projection (e.g., title, _url) are returned.
3. Bypass projection: Append project[<field>]=1 query parameters for any fields you wish to exfiltrate, pre-populating the MongoDB projection state before the security check runs:

   curl 'http://target.example.com/api/v1/article?project[internalNotes]=1&project[title]=1&project[slug]=1&project[createdAt]=1'

4. Enumerate additional fields: Expand the parameter list to request all desired restricted fields:

   curl 'http://target.example.com/api/v1/article?project[_id]=1&project[title]=1&project[slug]=1&project[visibility]=1&project[type]=1&project[createdAt]=1&project[updatedAt]=1'

5. Exfiltrate data: Parse the JSON response, which now includes all requested fields regardless of the administrator's publicApiProjection configuration (GitHub Advisory).

• Network: Unusual GET requests to /api/v1/<piece-type> endpoints containing project[ in the query string (e.g., ?project[internalNotes]=1); high-volume or automated requests to piece-type REST API endpoints from a single IP.
• Logs: Web server or application access logs showing requests to /api/v1/* with query parameters matching the pattern project%5B (URL-encoded project[) or project[ from unauthenticated sessions; repeated requests for fields not normally included in API responses.
• Application Behavior: API responses returning fields beyond those defined in publicApiProjection (e.g., internalNotes, slug, createdAt, updatedAt, visibility) to unauthenticated callers (GitHub Advisory).

Upgrade ApostropheCMS to version 4.29.0 or later, which removes the conditional else if (!query.state.project) check and unconditionally applies publicApiProjection for unauthenticated callers, matching the behavior of the page module (Patch Commit). If immediate patching is not possible, restrict network access to the REST API endpoints (e.g., via firewall rules or reverse proxy authentication) or require authentication for all API access as a temporary workaround. Version 4.29.0 also addresses a related secondary issue where the choices and counts query builders could leak distinct values of fields excluded by publicApiProjection via MongoDB's distinct operator (Patch Commit 2).