CVE-2026-39857: 
JavaScript vulnerability analysis and mitigation

CVE-2026-39857 is an information disclosure vulnerability in ApostropheCMS, an open-source Node.js content management system, where the choices and counts REST API query parameters bypass publicApiProjection field restrictions. Affecting versions 4.28.0 and prior, the flaw allows unauthenticated attackers to extract distinct field values from any schema field with a registered query builder, including fields explicitly excluded from the public API projection. It was published on April 15, 2026, with a patch released in version 4.29.0. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) (Github Advisory, Security Advisory).

The root cause (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) lies in how the choices and counts query builders are processed before the publicApiProjection MongoDB projection is applied. Specifically, getRestQuery calls applyBuildersSafely(req.query) first, which processes the choices and counts parameters; the projection is only applied afterward on the main query. The toDistinct method then executes db.distinct(property, criteria) — a MongoDB operation that inherently ignores projections — and the results are returned directly in the API response without filtering through publicApiProjection or removeForbiddenFields. This affects all schema field types with registered query builders (string, integer, float, select, boolean, date, slug, relationship), and the same bypass applies to viewPermission-protected fields since removeForbiddenFields only processes toArray() results. Both the piece-type REST API (piece-type/index.js:292-296) and page REST API (page/index.js:371-376) are affected (Security Advisory, Patch Commit).

An unauthenticated remote attacker can enumerate all distinct values of any schema field — including those explicitly excluded from the public API projection and those protected by viewPermission role-based access controls. The counts variant additionally discloses how many documents hold each distinct value, revealing statistical information about the dataset. While integrity and availability are unaffected, the confidentiality impact includes exposure of sensitive CMS data such as internal status values, priority levels, internal categories, and restricted content fields across all piece types and pages with a configured publicApiProjection (Github Advisory).

A proof-of-concept exploit is publicly available in the GitHub security advisory, consisting of simple curl commands requiring no authentication or special tooling. There is no evidence of in-the-wild exploitation at this time, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.031% (9th percentile), indicating a low near-term exploitation probability. No threat actor attribution has been reported (Security Advisory, Github Advisory).

1. Reconnaissance: Identify internet-facing ApostropheCMS instances running version 4.28.0 or earlier. Look for publicly accessible REST API endpoints (e.g., /api/v1/<piece-type>) that return results, indicating publicApiProjection is configured.
2. Enumerate available piece types: Access the standard REST API endpoint (e.g., curl -s 'http://target:3000/api/v1/article') to confirm the API is public and identify which fields appear in normal responses.
3. Extract distinct field values via choices: Send a request with the choices query parameter specifying a field name not present in the normal API response:

   curl -s 'http://target:3000/api/v1/article?choices=status' | python3 -m json.tool

   The response will include all distinct values for the status field (e.g., draft, published) even though it is excluded from the projection.
4. Extract document counts via counts: Use the counts parameter to also reveal how many documents have each distinct value:

   curl -s 'http://target:3000/api/v1/article?counts=priority' | python3 -m json.tool

5. Enumerate multiple fields simultaneously: Combine multiple field names in a single request to maximize data extraction efficiency:

   curl -s 'http://target:3000/api/v1/article?choices=status,priority,internalNotes'

6. Target viewPermission-protected fields: Repeat the above steps targeting fields known or suspected to have viewPermission restrictions, as these are equally exposed through this bypass (Security Advisory).

• Network: Unusual HTTP GET requests to /api/v1/<piece-type> endpoints containing choices= or counts= query parameters with field names not normally used in UI filtering; repeated enumeration of multiple field names across requests from the same source IP.
• Logs: Web server or application access logs showing requests such as GET /api/v1/article?choices=status, GET /api/v1/article?counts=priority, or GET /api/v1/article?choices=status,priority,internalNotes from unauthenticated sessions; high volume of such requests from a single IP suggesting automated enumeration.
• Application Behavior: API responses containing choices or counts keys with values for fields not included in the configured publicApiProjection, observable in application-level logging if response bodies are captured (Security Advisory).

The primary remediation is to upgrade ApostropheCMS to version 4.29.0, which introduces choicesFieldAllowedByProjection and choicesFieldAllowedByViewPermission checks in the choices builder's after handler to enforce field-level access controls before returning distinct values (Patch Commit). If immediate patching is not feasible, consider restricting network-level access to the REST API endpoints or requiring authentication for all API access as a temporary workaround. Organizations should also audit their publicApiProjection configurations to understand which sensitive fields may have been exposed (Github Advisory).