5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-39857

CVE-2026-39857: Information Disclosure via `choices`/`counts` Query Parameters Bypassing publicApiProjection Field Restrictions

ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain an authorization bypass vulnerability in the choices and counts query parameters of the REST API, where these query builders execute MongoDB distinct() operations that bypass the publicApiProjection restrictions intended to limit which fields are exposed publicly. The choices and counts parameters are processed via applyBuildersSafely before the projection is applied, and MongoDB's distinct operation does not respect projections, returning all distinct values directly. The results are returned in the API response without any filtering against publicApiProjection or removeForbiddenFields. An unauthenticated attacker can extract all distinct field values for any schema field type that has a registered query builder, including string, integer, float, select, boolean, date, slug, and relationship fields. Fields protected with viewPermission are similarly exposed, and the counts variant additionally reveals how many documents have each distinct value. Both the piece-type and page REST APIs are affected. This issue has been fixed in version 4.29.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-39857

CVE-2026-39857:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
apostrophe	npm	<= 4.28.0	4.29.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an information disclosure flaw in ApostropheCMS's REST API, affecting both piece-types and pages. The root cause is that the choices and counts query parameters trigger a data retrieval path that does not respect the security restrictions configured for the main API endpoint. Specifically, the after handler for the choices query builder (located in @apostrophecms/doc-type/index.js) would fetch distinct values for any requested schema field using MongoDB's distinct operation. This operation inherently ignores projections, meaning the publicApiProjection intended to limit publicly visible fields was bypassed. Additionally, the handler did not perform any checks for viewPermission on fields.

The vulnerable flow starts in the getRestQuery methods of the @apostrophecms/piece-type and @apostrophecms/page modules. These methods set up the main query and apply the publicApiProjection but, prior to the patch, failed to pass the projection information to the query object for other parts of the system to use. The choices builder's after handler, therefore, had no awareness of the projection and proceeded to fetch and return distinct values for fields that should have been protected.

The patch addresses this by modifying getRestQuery in both modules to store the publicApiProjection on the query object. Then, the choices builder's after handler is updated to use this information to explicitly check if a field is allowed by the projection and by any viewPermission before attempting to retrieve its distinct values. My analysis identified these three functions as the key components of the vulnerable execution path.

Vulnerable functions

@apostrophecms/doc-type:builders.choices.after

packages/apostrophe/modules/@apostrophecms/doc-type/index.js

This function is an 'after' handler for the 'choices' and 'counts' query builders. The vulnerability lies in its failure to check if the fields requested for distinct value extraction are permitted by the `publicApiProjection` or `viewPermission`. It directly calls `_query.toChoices`, which uses MongoDB's `distinct` method. The `distinct` method ignores projections, thus leaking values of fields that are supposed to be protected. The patch adds checks to ensure the fields are allowed before fetching their distinct values.

@apostrophecms/piece-type.getRestQuery

packages/apostrophe/modules/@apostrophecms/piece-type/index.js

This function prepares the REST API query for piece types. The vulnerability is that while it applies the `publicApiProjection` to the main query results, it fails to pass the projection information down to the query object itself. This prevents the `choices` builder's `after` handler from being able to enforce the projection. The fix involves adding `query.set('publicApiProjection', ...)` so that the projection rules are available to other parts of the query execution pipeline.

@apostrophecms/page.getRestQuery

packages/apostrophe/modules/@apostrophecms/page/index.js

Similar to the piece-type's `getRestQuery`, this function prepares the query for the page REST API. It was vulnerable for the same reason: it did not propagate the `publicApiProjection` to the query object, allowing the `choices` and `counts` builders to bypass field restrictions. The patch adds the same fix of setting the projection on the query object.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.