CVE-2026-110904

Executive Summary

CVE-2026-110904 is an authentication bypass vulnerability in ApostropheCMS that permits unauthenticated reading of REST API page data prior to version 4.33.0. Any deployment of the affected versions that exposes the ApostropheCMS REST API endpoint described in the advisory is potentially impacted, allowing an attacker to enumerate and retrieve page content, including unpublished or restricted pages, without holding valid credentials. The CVSS base score is 5.3, reflecting the confidentiality-only impact (C:L) and no integrity or availability effect. No public proof-of-concept, Nuclei template, or exploit code has been observed at time of writing.

Technical Analysis

The CNA/NVD description states that ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, and provides a specific demonstrating request: /api/v1/@apostrophecms/page?all=1. The vulnerability class is CWE-863 (Incorrect Authorization), which means an access-control check that is either absent, misordered, or applied to the wrong request context fails to enforce the intended privilege requirement.

At a mechanistic level, the described behavior indicates that the REST API route responsible for reading pages under the @apostrophecms/page module does not correctly bind its authorization decision to the caller's authenticated state. The all=1 query parameter is described in the advisory as part of the demonstrating call, which implies that page retrieval semantics can be broadened by that parameter and that the authorization gate should have rejected an anonymous caller before any result set is returned. Whether the bypass stems from a missing pre-controller authentication middleware on that route, an authorization decision keyed on a parameter the client controls, or a default-permit branch in the module's route policy cannot be determined from the available description. No function names, class names, file paths, or additional API parameters are provided in the source data, and none are invented here.

The attack surface is any internet- or intranet-reachable ApostropheCMS 4.x instance exposing the versioned REST API namespace /api/v1/. The all=1 parameter is the only client-controlled element explicitly named in the vulnerability description. Exploitation requires network reachability to the API and no prior authentication (CVSS PR:N, AC:L, UI:N), which lowers the barrier substantially: no credential harvesting, session fixation, or user interaction is required.

Because the impact metrics restrict to confidentiality (C:L, I:N, A:N), the flaw does not permit modification or destruction of content through the described path. The exposure is read-oriented — content disclosure rather than state change. That distinction matters for prioritization: the primary risk is leakage of page data that the site owner did not intend to publish or expose to anonymous callers, which can include drafts, staged content, internal metadata, or access-restricted sections depending on how the instance is configured. The exact scope of what all=1 returns in a given deployment is a function of that deployment's content model and cannot be asserted beyond what the advisory states.

The patch state is significant. Patch confidence is 0/4; no patch evidence exists from any tracked source, and no vendor fix or workaround is listed. Affected version ranges from tracked package data are not available. The downstream operational consequence is that defenders cannot rely on a vendor-provided remediation artifact being present in their patch pipeline; version-conditional logic must be based on the advisory's stated boundary of "before 4.33.0" and verified directly against the deployed instance.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-863) and the demonstrating request named in the NVD description. Only the endpoint /api/v1/@apostrophecms/page, the parameter all=1, and the authentication-bypass behavior are taken from the source data.

1. Reconnaissance and target identification. An adversary identifies ApostropheCMS deployments through passive and active fingerprinting. Shodan can locate candidate hosts using http.html:"apos", http.title:"Apostrophe", http.html:"/_apos", or http.component:"ApostropheCMS". Direct probing of known asset inventories, subdomain enumeration, or internet-wide scanning for the /api/v1/ namespace against /@apostrophecms/page achieves the same result. The attacker's objective at this stage is to confirm the product and, where possible, the major version, because the flaw is bounded to releases before 4.33.0.

2. Trigger of the flaw class. The attacker issues an unauthenticated HTTP request to the page-reading route with the broadening parameter, i.e., a call to /api/v1/@apostrophecms/page?all=1. Under correct CWE-863 handling, the server would evaluate the caller's identity and authorization before executing the read handler and would reject an anonymous request with an authorization error. In the vulnerable state, the authorization check is not correctly enforced for this route, so the read handler proceeds. No credentials, tokens, or session cookies are supplied; the bypass is a function of the missing or ineffective check, not of credential manipulation.

3. Execution method at the vulnerability-class level. The "payload" here is simply the crafted HTTP GET request itself — the endpoint path plus the all=1 query parameter. There is no code injection, serialization gadget, or shell payload involved. The attacker iterates the request, potentially varying it against multiple hosts or repeating it to build a corpus of returned records. Any credentials-free variation that the route accepts is within scope of the bypass, but no additional parameters are named in the advisory and none should be assumed.

4. Post-exploitation impact. Returned responses constitute the disclosure of page data. The attacker aggregates the results to map the site's content, identify unpublished or access-restricted pages, and harvest material for follow-on activity — for example, targeting an organization through staging content, internal notes, or pre-publication announcements that reveal business plans, personnel, or technical details. Because I:N and A:N apply, the described vulnerability alone does not grant write access; escalation would require a separate flaw. The read primitive is nonetheless valuable for reconnaissance and for chaining with subsequent attacks that depend on knowledge of internal content structure.

Impact Assessment

The CVSS v3.1 base score is 5.3 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. Reading the subscores: attack vector Network means the flaw is exploitable remotely across network boundaries; attack complexity Low means no special conditions, race windows, or target-specific knowledge are required beyond reachability; privileges required None and user interaction None mean the request is anonymous and self-contained. Scope is Unchanged — the vulnerable component's authorization failure affects only its own security context. Confidentiality impact is Low, which in CVSS terms means some restricted information is disclosed but the attacker does not gain control over the amount or nature of all data on the system. Integrity and availability impacts are None: the described request reads pages and does not alter or degrade the service.

Business impact centers on information disclosure. Affected systems are ApostropheCMS deployments prior to 4.33.0 with a reachable /api/v1/ interface. The blast radius is the content set the page route returns when queried with the broadening parameter: where a site uses Apostrophe's page model to hold drafts, gated material, or unpublished announcements, those items may fall within the disclosure. Organizations that treat CMS editorial state as sensitive — publishers with embargoed material, enterprises staging product or campaign pages, and any tenant whose CMS is co-located with internal-facing content — carry the highest exposure.

Prioritization should be deliberate. The score is Medium, there is no CISA KEV listing, and the EPSS score has not been published by FIRST.org — no probability estimate should be attributed to this CVE. Exploit prerequisites, however, are as low as they come (PR:N, UI:N, AC:L), the endpoint is predictable from the product's public routing conventions, and no public exploit code is required to attempt the request. That combination favors prompt remediation on external-facing instances even absent active exploitation reporting.

Detection Guidance

Sigma Rule

title: ApostropheCMS REST API Page Authentication Bypass Attempt (CVE-2026-110904)
id: 8f2c1a44-5b7e-4d19-9c33-a1b2c3d4e5f6
status: experimental
description: Detects unauthenticated requests to the ApostropheCMS REST API page endpoint using the 'all' parameter, consistent with CVE-2026-110904.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-110904
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-stem|contains: '/api/v1/@apostrophecms/page'
  selection_param:
    cs-uri-query|contains: 'all=1'
  condition: selection_uri and selection_param
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - sc-status
falsepositives:
  - Authorized administrative or integration clients that legitimately request all pages
level: high

YARA Rule

rule CVE_2026_110904_ApostropheCMS_AuthBypass
{
    meta:
        description = "Detects HTTP request artifacts targeting the ApostropheCMS REST API page endpoint with the all=1 parameter (CVE-2026-110904)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-110904"
        severity = "high"

    strings:
        $uri = "/api/v1/@apostrophecms/page" ascii nocase
        $param = "all=1" ascii nocase
        $m1 = "GET " ascii
        $m2 = "HTTP/1." ascii

    condition:
        ($uri and $param) and ($m1 or $m2)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-110904 ApostropheCMS REST API page auth bypass attempt (all=1)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/v1/@apostrophecms/page"; http.uri; content:"all=1"; classtype:attempted-recon; reference:cve,2026-110904; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-110904; sid:900110904; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [ network where network.protocol == "http" and
      http.request.method == "GET" and
      http.request.uri contains "/api/v1/@apostrophecms/page" and
      http.request.uri contains "all=1" ]

Splunk SPL Query

index=web sourcetype=access_combined
| where match(uri, "(?i)/api/v1/@apostrophecms/page") AND match(uri, "(?i)[?&]all=1")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(status) as status_codes
        values(uri) as uris
        dc(uri) as unique_uris
        by clientip
| where count > 0
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count

Wazuh OSSEC Rule

<group name="web,apostrophecms,attack,">
  <rule id="110904" level="12">
    <if_sid>31100</if_sid>
    <id>^GET</id>
    <url>/api/v1/@apostrophecms/page\?.*all=1</url>
    <description>CVE-2026-110904: ApostropheCMS REST API page auth bypass attempt detected (all=1)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_110904,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or workaround is listed, and no affected package version data is available from tracked sources.

1. Immediate mitigations. Because no authoritative fix artifact is confirmed, containment must be enforced at the perimeter. Block or restrict access to the /api/v1/@apostrophecms/page route, and more broadly to the /api/v1/ namespace, for untrusted networks at the reverse proxy, WAF, or load balancer. Require authentication at that layer so requests to the page endpoint cannot be satisfied anonymously. Where the CMS does not legitimately expose its REST API to the public internet, remove external reachability entirely — this single control eliminates the described attack surface. Monitor application and proxy logs for requests matching the endpoint-plus-all=1 pattern using the detections above, and treat any successful 200 responses to anonymous callers as a potential disclosure event requiring review.

2. Patch and upgrade steps. The advisory boundary is version 4.33.0 or later. Inventory all ApostropheCMS instances in the estate, record their versions, and prioritize externally reachable systems. Upgrade every instance below 4.33.0 to 4.33.0 or later, following the project's normal upgrade procedure and validating the REST API authorization behavior after the change. Because patch confidence is 0/4 and no vendor fix reference is available, the upgrade target should be treated as the advisory's stated fixed version; independently verify after upgrade that an unauthenticated request to /api/v1/@apostrophecms/page?all=1 no longer returns page data. Do not assume a previously released minor version is unaffected without confirming its version is at or above 4.33.0.

3. Long-term hardening. Enforce authentication and authorization as a mandatory, centralized pre-condition on all data-returning API routes, and add automated regression tests that assert anonymous requests to page-reading endpoints fail. Adopt deny-by-default route policies in the CMS so that a missing check fails closed rather than open. Maintain continuous external attack-surface monitoring (Shodan or equivalent) to detect unintended exposure of CMS API endpoints. Track the CVE record for the eventual publication of a CVSS-adjusted score, EPSS estimate, vendor advisory, and any CISA KEV addition, and re-prioritize at that time.

References

• NVD — CVE-2026-110904: https://nvd.nist.gov/vuln/detail/CVE-2026-110904
• CWE-863: Incorrect Authorization: https://cwe.mitre.org/data/definitions/863.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• ApostropheCMS official project and release notes: https://apostrophecms.com/ (consult for the 4.33.0 release and any security advisory)
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-110904 is not listed as of this writing)

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-110904 in the provided data. EPSS has not yet been scored by FIRST.org; no probability estimate is available.