CVE-2026-113660 in ApostropheCMS
Summary
by MITRE • 10/20/2026
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, ApostropheCMS’s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mode, including draft mode. The endpoint returns localized document identifiers without applying document-level view or edit authorization criteria. This issue is fixed in version 4.33.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/20/2026
ApostropheCMS is an open-source content management system built on the Node.js platform, widely utilized for managing digital assets and web content. A significant security flaw was identified within its API layer prior to version 4.33.0, specifically concerning the exist-in-locale endpoint. This vulnerability stems from a failure in implementing proper access control mechanisms when handling localized document queries. The core issue lies in how the system processes requests to check for the existence of documents across different locales and modes, such as draft or published states. While the API requires authentication, it does not adequately enforce role-based permissions at the individual document level during this specific operation.
The technical flaw allows an authenticated user with low privileges to perform information disclosure by determining whether restricted documents exist within a specified locale. When a request is made to the exist-in-locale endpoint, the system returns localized document identifiers if they are present in the database for that locale and mode. Crucially, this response is generated without applying standard document-level view or edit authorization criteria. In a properly secured environment, an API should verify whether the requesting user has permission to access specific content before revealing any metadata about it. By bypassing these checks, the vulnerability enables attackers to enumerate sensitive resources that they are not authorized to view or modify.
The operational impact of this vulnerability is primarily related to information leakage and reconnaissance. Although low-privilege users cannot directly read the contents of restricted documents through this specific endpoint, knowing which document identifiers exist allows them to map out the structure of the content management system. This knowledge can be leveraged in subsequent attacks, such as targeted brute-force attempts against known IDs or social engineering campaigns where attackers reference specific internal projects or drafts that were previously unknown to them. The ability to confirm the existence of draft-mode documents is particularly concerning, as it reveals ongoing work and potentially sensitive strategic information before publication.
This vulnerability aligns with CWE-200, which classifies Information Exposure, specifically detailing how an application exposes security-relevant information to unauthorized actors. It also relates to CWE-862, the lack of authorization for critical functionality, where the API endpoint fails to enforce proper access controls on a sensitive operation. From a threat modeling perspective using the MITRE ATT&CK framework, this behavior facilitates reconnaissance activities, allowing adversaries to gather intelligence about the target environment's structure and content organization without triggering typical intrusion detection alerts associated with direct data exfiltration.
To mitigate this risk, organizations running ApostropheCMS must upgrade immediately to version 4.33.0 or later, where the issue has been resolved by enforcing proper authorization checks on document identifiers returned by the exist-in-locale API. For systems that cannot be upgraded instantly due to compatibility constraints, administrators should consider implementing a reverse proxy or Web Application Firewall rule to restrict access to this specific endpoint based on user roles. Additionally, auditing existing code for similar patterns where localized data retrieval bypasses standard permission checks is recommended to prevent analogous vulnerabilities in other parts of the application logic. Regular security assessments and penetration testing focusing on API authorization flows are essential to maintain a robust security posture against information disclosure attacks.