{"id":"CVE-2026-113668","aliases":["EUVD-2026-105216","GHSA-gqh3-7856-rjjg"],"status":"published","title":"ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)","description":"ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the REST route GET /api/v1/\u003cpiece-type\u003e/:_id/locales (and the equivalent page route) does not apply the publicApiCheckAsync gate that ApostropheCMS's other read routes enforce. An unauthenticated caller can therefore query this route for any document _id and learn whether the document exists and which locales it is published in — a document-existence and locale-metadata disclosure that the read-API is otherwise supposed to gate. This issue is fixed in version 4.33.0.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00322,"percentile":0.25577,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-862"],"published":"2026-10-20T17:32:07Z","modified":"2026-11-11T02:48:45Z","fixes":[{"ecosystem":"npm","package":"apostrophe","fixed_in":["4.33.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"apostrophe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.33.0"}]}]},{"source":"osv","ecosystem":"npm","package":"apostrophe","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.33.0"}]}]}],"products":[{"vendor":"apostrophecms","product":"apostrophe"}],"references":[{"url":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-gqh3-7856-rjjg","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-gqh3-7856-rjjg"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/113xxx/CVE-2026-113668.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113668","tags":["advisory"]},{"url":"https://github.com/apostrophecms/apostrophe","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-113668","title":"ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)","description":"ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the REST route GET /api/v1/\u003cpiece-type\u003e/:_id/locales (and the equivalent page route) does not apply the publicApiCheckAsync gate that ApostropheCMS's other read routes enforce. An unauthenticated caller can therefore query this route for any document _id and learn whether the document exists and which locales it is published in — a document-existence and locale-metadata disclosure that the read-API is otherwise supposed to gate. This issue is fixed in version 4.33.0.","status":"published","published":"2026-10-20T17:32:07.486Z","modified":"2026-10-20T19:04:47.799Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-200","CWE-862"],"updated_at":"2026-11-02T13:44:29.519518Z"}],"euvd":[{"id":"EUVD-2026-105216","description":"ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the REST route GET /api/v1/\u003cpiece-type\u003e/:_id/locales (and the equivalent page route) does not apply the publicApiCheckAsync gate that ApostropheCMS's other read routes enforce. An unauthenticated caller can therefore query this route for any document _id and learn whether the document exists and which locales it is published in — a document-existence and locale-metadata disclosure that the read-API is otherwise supposed to gate. This issue is fixed in version 4.33.0.","status":"published","published":"2026-10-20T17:32:07Z","modified":"2026-10-20T19:04:47Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:59:43.145678Z"}],"ghsa":[{"id":"GHSA-gqh3-7856-rjjg","title":"ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)","description":"## Summary\nThe REST route `GET /api/v1/\u003cpiece-type\u003e/:_id/locales` (and the equivalent page route) does not apply the `publicApiCheckAsync` gate that ApostropheCMS's other read routes enforce. An unauthenticated caller can therefore query this route for any document `_id` and learn whether the document exists and which locales it is published in — a document-existence and locale-metadata disclosure that the read-API is otherwise supposed to gate.\n \n## Affected\n- Repository: `apostrophecms/apostrophe` (monorepo package `apostrophe`).\n- Confirmed at **4.32.2** (commit `d3ff8c9` == the shipped 4.32.2; unchanged at current HEAD). No fix at time of report.\n- Stack: Node.js / Express + MongoDB.\n- Endpoints: `GET /api/v1/\u003cpiece-type\u003e/:_id/locales` and `GET /api/v1/@apostrophecms/page/:_id/locales`.\n\n## Technical detail\n- Unsafe: `modules/@apostrophecms/piece-type/index.js:397` registers the `:_id/locales` route with **no** `publicApiCheckAsync`. The page module has the same omission at `modules/@apostrophecms/page/index.js:925`.\n- Gated siblings: the read routes in the same module (e.g. `getAll` at `piece-type/index.js:256-263`) call `publicApiCheckAsync` (`:263`) to enforce the public-API access policy.\n- So the `locales` handler (which calls `getLocales()` for the document) runs for any caller regardless of the public-API gate the other read routes apply, returning the document's locale/publication metadata without authorization.\n\n## Impact\n\nAn unauthenticated caller can confirm the existence of a document by `_id` and enumerate its locales/publication state — information the read-API is meant to gate. Defensibly 4.3 (AC:H) given the opaque `_id` precondition (the caller needs a document id).\n \n## How it was verified (local only)\nReproduced against `apostrophe@4.32.2` (== commit `d3ff8c9`) locally with synthetic content:\n- Source review confirmed the `:_id/locales` route lacks `publicApiCheckAsync` while the sibling read routes have it.\n- An **unauthenticated** `GET /api/v1/\u003cpiece-type\u003e/\u003c_id\u003e/locales` returned the document's locale metadata (existence + locales), while the gated read routes (e.g. `getAll`) correctly required the public-API policy.\n- Control: the same route with the `publicApiCheckAsync` gate added (matching the siblings) denies the unauthenticated request — isolating the missing gate as the cause.\nSynthetic content only; nothing hosted was touched.\n \n## Remediation\nAdd the `publicApiCheckAsync` (or equivalent) authorization gate to the `:_id/locales` route in both the piece-type and page modules, matching the sibling read routes, so the locale/existence metadata is only returned to callers permitted by the public-API policy.\n \n## Credit\nPlease credit **Santosh Kumar Puppala** (https://github.com/Santoshkumarpuppala).","status":"published","published":"2026-10-20T18:14:32Z","modified":"2026-10-20T18:14:33Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-862"],"updated_at":"2026-11-02T14:41:33.669646Z"}],"nvd":[{"id":"CVE-2026-113668","description":"ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the REST route GET /api/v1/\u003cpiece-type\u003e/:_id/locales (and the equivalent page route) does not apply the publicApiCheckAsync gate that ApostropheCMS's other read routes enforce. An unauthenticated caller can therefore query this route for any document _id and learn whether the document exists and which locales it is published in — a document-existence and locale-metadata disclosure that the read-API is otherwise supposed to gate. This issue is fixed in version 4.33.0.","status":"published","published":"2026-10-20T18:17:20.41Z","modified":"2026-10-20T19:53:10.247Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-200","CWE-862"],"updated_at":"2026-11-02T14:13:01.161484Z"}],"osv":[{"id":"CVE-2026-113668","title":"ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)","description":"ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the REST route GET /api/v1/\u003cpiece-type\u003e/:_id/locales (and the equivalent page route) does not apply the publicApiCheckAsync gate that ApostropheCMS's other read routes enforce. An unauthenticated caller can therefore query this route for any document _id and learn whether the document exists and which locales it is published in — a document-existence and locale-metadata disclosure that the read-API is otherwise supposed to gate. This issue is fixed in version 4.33.0.","status":"published","published":"2026-10-20T17:32:07.486Z","modified":"2026-11-11T10:47:24.934855184Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-862"],"updated_at":"2026-11-11T03:22:00.901153Z"},{"id":"GHSA-gqh3-7856-rjjg","title":"ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)","description":"## Summary\nThe REST route `GET /api/v1/\u003cpiece-type\u003e/:_id/locales` (and the equivalent page route) does not apply the `publicApiCheckAsync` gate that ApostropheCMS's other read routes enforce. An unauthenticated caller can therefore query this route for any document `_id` and learn whether the document exists and which locales it is published in — a document-existence and locale-metadata disclosure that the read-API is otherwise supposed to gate.\n \n## Affected\n- Repository: `apostrophecms/apostrophe` (monorepo package `apostrophe`).\n- Confirmed at **4.32.2** (commit `d3ff8c9` == the shipped 4.32.2; unchanged at current HEAD). No fix at time of report.\n- Stack: Node.js / Express + MongoDB.\n- Endpoints: `GET /api/v1/\u003cpiece-type\u003e/:_id/locales` and `GET /api/v1/@apostrophecms/page/:_id/locales`.\n\n## Technical detail\n- Unsafe: `modules/@apostrophecms/piece-type/index.js:397` registers the `:_id/locales` route with **no** `publicApiCheckAsync`. The page module has the same omission at `modules/@apostrophecms/page/index.js:925`.\n- Gated siblings: the read routes in the same module (e.g. `getAll` at `piece-type/index.js:256-263`) call `publicApiCheckAsync` (`:263`) to enforce the public-API access policy.\n- So the `locales` handler (which calls `getLocales()` for the document) runs for any caller regardless of the public-API gate the other read routes apply, returning the document's locale/publication metadata without authorization.\n\n## Impact\n\nAn unauthenticated caller can confirm the existence of a document by `_id` and enumerate its locales/publication state — information the read-API is meant to gate. Defensibly 4.3 (AC:H) given the opaque `_id` precondition (the caller needs a document id).\n \n## How it was verified (local only)\nReproduced against `apostrophe@4.32.2` (== commit `d3ff8c9`) locally with synthetic content:\n- Source review confirmed the `:_id/locales` route lacks `publicApiCheckAsync` while the sibling read routes have it.\n- An **unauthenticated** `GET /api/v1/\u003cpiece-type\u003e/\u003c_id\u003e/locales` returned the document's locale metadata (existence + locales), while the gated read routes (e.g. `getAll`) correctly required the public-API policy.\n- Control: the same route with the `publicApiCheckAsync` gate added (matching the siblings) denies the unauthenticated request — isolating the missing gate as the cause.\nSynthetic content only; nothing hosted was touched.\n \n## Remediation\nAdd the `publicApiCheckAsync` (or equivalent) authorization gate to the `:_id/locales` route in both the piece-type and page modules, matching the sibling read routes, so the locale/existence metadata is only returned to callers permitted by the public-API policy.\n \n## Credit\nPlease credit **Santosh Kumar Puppala** (https://github.com/Santoshkumarpuppala).","status":"published","published":"2026-10-20T18:14:32Z","modified":"2026-10-20T18:30:03.574883961Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-862"],"updated_at":"2026-11-02T15:46:48.191583Z"}]}}