{"id":"CVE-2026-112954","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-112954","generatedAt":"2026-10-28T03:38:39.513Z","title":"Prior to 4.34.0, a public REST API type that uses publicApiProjection can expose excluded searchable or sortable field information through search membership and sort ordering oracles.","description":"ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a public REST API type that uses publicApiProjection can expose excluded searchable or sortable field information through search membership and sort ordering oracles. Returned fields remain filtered by the projection, so the issue permits targeted inference about hidden values rather than an unrestricted field dump. This issue is fixed in version 4.34.0.","published":"2026-10-20T16:17:06.000Z","lastModified":"2026-10-23T02:16:55.000Z","status":"Deferred","sourceIdentifier":"security-advisories@github.com","cvss":{"version":"3.1","score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},"cwe":["CWE-200"],"affected":[],"epss":{"score":0.00444,"percentile":0.3847,"date":"2026-10-27","history":[{"date":"2026-10-21","score":0.00307,"percentile":0.22247}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.44%). Track it; it rarely justifies an emergency change on its own."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-20T16:17:06.000Z","detail":{"score":"5.3","severity":"MEDIUM","publishedAt":"2026-10-20T16:17:06.367Z"},"summary":"New CVE, medium severity (CVSS 5.3)."}],"references":[{"url":"https://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498","source":"security-advisories@github.com"},{"url":"https://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea","source":"security-advisories@github.com"},{"url":"https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.34.0","source":"security-advisories@github.com"},{"url":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-rqgm-cfrp-4hx8","source":"security-advisories@github.com"},{"url":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-rqgm-cfrp-4hx8","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-112954","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}