ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users

Summary

The getOne REST endpoint for pages does not apply viewRole type-level restrictions
or viewPermission field-level redaction. An editor-level user who knows a document
_id can read the full content of admin-only pages and their privileged fields, while
the getAll endpoint correctly enforces both restrictions.

Details

Finding 3 — viewRole bypass:
modules/@apostrophecms/page/index.js exposes getRestQuery(req, omitPermissionCheck = false). The getAll path calls publicApiCheckAsync and threads the full query builder
pipeline including viewRole filtering. The getOne path uses a divergent code path
that skips this pipeline.

A page type declared with viewRole: 'admin' is inaccessible via GET /api/v1/@apostrophecms/page?type=secretPage (returns 403 to an editor) but is fully
returned by GET /api/v1/@apostrophecms/page/:id:en:published to the same editor.

Finding 4 — viewPermission field leak:
Fields decorated with viewPermission: { action: 'edit', type: '@apostrophecms/page' }
are stripped by removeForbiddenFields in the getAll path but are returned verbatim
in getOne. An editor who knows any document _id can read all
viewPermission-restricted fields.

PoC

# Log in as editor, get session jar
EDITOR_JAR="..."

# getAll — correctly blocked
curl -b "$EDITOR_JAR" \
  "http://TARGET/api/v1/@apostrophecms/page?type=secretPage"
# → 403 Forbidden

# getOne — bypassed, returns full document including viewPermission fields
curl -b "$EDITOR_JAR" \
  "http://TARGET/api/v1/@apostrophecms/page/ADMIN_PAGE_ID:en:published"
# → 200 OK, full doc including secretField value

Impact

Editors can read the full content of any page — including those restricted to admins via
viewRole — if they know or can guess the _id. Sensitive field values gated by
viewPermission are also fully exposed. This breaks the content access control model
for any site using these decorators.