CVE-2026-113653

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.33.0

Description In this Node.js content management system, the viewRole is not applied to anonymous visitors when a developer exposes user objects through a publicly rendered relationship or an expressly enabled public API. This can lead to the conditional disclosure of user fields if templates are inadequately limited, such as when an entire related user object is serialized into JSON. This issue allows the general public to potentially access secured content types like @apostrophecms/user.

Recommendations Update to version 4.33.0. Avoid creating relationships with @apostrophecms/user intended for non-admin display; instead, create a separate author piece type for public representation.