CVE-2026-113660
Received Received - Intake

ApostropheCMS Information Disclosure via Locale API

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: GitHub, Inc.

Description
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, ApostropheCMS’s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mode, including draft mode. The endpoint returns localized document identifiers without applying document-level view or edit authorization criteria. This issue is fixed in version 4.33.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-113660
EUVD
EUVD-2026-105208

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apostrophecms apostrophe < 4.33.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ApostropheCMS versions before 4.33.0 have an authorization bypass in the exist-in-locale API endpoint. An authenticated low-privilege user can check if restricted documents exist in specific locales or draft modes without proper permission checks. The endpoint queries the database directly using user-controlled parameters but does not enforce document-level view or edit authorization criteria.

Detection Guidance

To detect this vulnerability, monitor API requests to POST /api/v1/@apostrophecms/i18n/exist-in-locale. Check for unusual queries from low-privilege users attempting to probe document existence across locales or draft modes. Review server logs for repeated requests with varying document IDs.

Impact Analysis

This vulnerability allows low-privilege users to probe for and identify restricted documents, including drafts, by their localized identifiers. While it does not expose document content or grant write permissions, it enables reconnaissance of sensitive content existence, potentially aiding further attacks.

Compliance Impact

This vulnerability could impact compliance by exposing the existence of restricted documents, potentially violating confidentiality requirements under GDPR or HIPAA. Unauthorized disclosure of document existence may lead to regulatory penalties or breaches of data protection obligations.

Mitigation Strategies

Immediately upgrade ApostropheCMS to version 4.33.0 or later. If upgrading is not possible, restrict access to the exist-in-locale endpoint by implementing proper authorization checks at the application level. Review and apply document-level permissions for all API endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113660. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart