CVE-2026-39857

CYBERSECURITY BRIEFING NOTE OVERVIEW CVE-2026-39857 is an authorization bypass vulnerability affecting ApostropheCMS, an open-source Node.js content management system, in versions 4.28.0 and prior. The flaw exists in the REST API's choices and counts query parameters, which execute MongoDB distinct() operations that bypass the publicApiProjection restrictions designed to limit publicly exposed fields. This allows unauthenticated attackers to extract sensitive field values from any schema field type with a registered query builder, including string, integer, float, select, boolean, date, slug, and relationship fields. Both the piece-type and page REST APIs are affected. SEVERITY The vulnerability carries a CVSS 3.1 score of 5.3 (MEDIUM) with a network-based attack vector, low complexity, and no authentication required. The impact is limited to confidentiality, with no integrity or availability implications. The primary risk is unauthorized information disclosure, as attackers can enumerate all distinct values for protected fields and determine document counts by field value, potentially exposing sensitive data architecture and content patterns. EXPLOITATION STATUS There is no current evidence of active exploitation in the wild. The vulnerability does not appear on the Known Exploited Vulnerabilities (KEV) catalog and is inactive on threat intelligence hot lists. However, the straightforward nature of the attack—requiring only unauthenticated API calls—suggests exploitation could be readily weaponized. The issue has been remediated in version 4.29.0, and organizations should upgrade immediately to mitigate exposure.