CVE-2026-113668
Received Received - Intake

Locale Disclosure in ApostropheCMS Prior to 4.33.0

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: GitHub, Inc.

Description
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the REST route GET /api/v1/<piece-type>/:_id/locales (and the equivalent page route) does not apply the publicApiCheckAsync gate that ApostropheCMS's other read routes enforce. An unauthenticated caller can therefore query this route for any document _id and learn whether the document exists and which locales it is published in — a document-existence and locale-metadata disclosure that the read-API is otherwise supposed to gate. This issue is fixed in version 4.33.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-113668
EUVD
EUVD-2026-105216

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apostrophecms apostrophe < 4.33.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ApostropheCMS versions before 4.33.0 have a flaw in the REST route GET /api/v1/<piece-type>/:_id/locales and its page route equivalent. These routes do not enforce the publicApiCheckAsync authorization gate, which other read routes use. This allows unauthenticated users to check if a document exists by its ID and see which locales it is published in, leading to unauthorized disclosure of document existence and locale metadata.

Detection Guidance

To detect this vulnerability, check if your ApostropheCMS version is below 4.33.0. Use the command: curl -X GET http://your-server/api/v1/piece-type/123/locales. If the server responds with document locale data without authentication, the system is vulnerable.

Impact Analysis

An attacker could exploit this to gather information about documents in the system without authentication. This includes confirming the existence of specific documents and their published locales, which may help in further attacks or data reconnaissance. The impact is limited to information disclosure and does not allow modification or deletion of data.

Compliance Impact

This vulnerability could lead to non-compliance with data protection regulations such as GDPR or HIPAA by exposing sensitive document metadata without authorization. Unauthorized access to document existence and locale information may violate privacy requirements that mandate strict access controls and protection of personal or sensitive data.

Mitigation Strategies

Immediately upgrade ApostropheCMS to version 4.33.0 or later. If upgrading is not possible, restrict access to the vulnerable routes by implementing authentication checks or network-level protections.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113668. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart