CVE-2026-113668 in ApostropheCMS
Summary
by MITRE • 10/20/2026
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the REST route GET /api/v1/<piece-type>/:_id/locales (and the equivalent page route) does not apply the publicApiCheckAsync gate that ApostropheCMS's other read routes enforce. An unauthenticated caller can therefore query this route for any document _id and learn whether the document exists and which locales it is published in — a document-existence and locale-metadata disclosure that the read-API is otherwise supposed to gate. This issue is fixed in version 4.33.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/20/2026
ApostropheCMS, an open-source content management system built on Node.js, contains a significant access control vulnerability affecting versions prior to 4.33.0. The core of the issue lies in an inconsistency within the REST API implementation regarding locale-specific document retrieval. Specifically, the GET endpoint for /api/v1/<piece-type>/:_id/locales fails to enforce the publicApiCheckAsync gate that is strictly applied to other read operations within the system. This architectural oversight creates a bypass mechanism for authentication and authorization checks, allowing unauthenticated actors to interact with sensitive backend logic without proper credentials or permissions.
The technical flaw manifests as an information disclosure vulnerability where attackers can probe arbitrary document identifiers. By sending requests to this specific endpoint with various _id values, an attacker can determine the existence of documents within the CMS database. Furthermore, the response reveals which locales are published for each queried document. This capability effectively allows external parties to map out the content structure and identify active publications without any prior access rights. The vulnerability is classified under CWE-200 as Information Exposure, specifically relating to the exposure of sensitive system information through API endpoints that lack proper input validation or authorization checks.
From an operational perspective, this disclosure provides attackers with valuable reconnaissance data. Knowledge of existing document IDs and their associated locales can facilitate further attacks, such as targeted brute-force attempts against specific content pieces or social engineering campaigns based on known organizational structures embedded in the CMS. The ability to enumerate published locales also aids in understanding the internationalization setup of the target environment, which may reveal security configurations or deployment patterns that could be exploited later. This aligns with ATT&CK technique T1087, Account Discovery, as it allows an adversary to gather information about accounts and resources within a networked environment through API enumeration rather than direct system access.
To mitigate this risk, organizations running ApostropheCMS must upgrade immediately to version 4.33.0 or later, where the publicApiCheckAsync gate has been correctly applied to all read routes including the locale-specific endpoint. Until an upgrade is feasible, administrators should consider implementing a Web Application Firewall rule to block direct access to the /api/v1/* locales endpoints from untrusted IP addresses. Additionally, it is advisable to audit other API endpoints for similar inconsistencies in authorization logic to ensure comprehensive protection against information disclosure vulnerabilities. Regular security assessments and code reviews focusing on REST API gate enforcement are recommended to prevent recurrence of such architectural oversights.