ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, ApostropheCMS’s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mode, including draft mode. The endpoint returns localized document identifiers without applying document-level view or edit authorization criteria. This issue is fixed in version 4.33.0.

Affected: npm: apostrophe

**Summary** ApostropheCMS’s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mode, including draft mode. The endpoint returns localized document identifiers without applying document-level view or edit authorization criteria.

The issue was reproduced against a real local ApostropheCMS application running the reviewed source code. The test used a synthetic guest account and synthetic restricted draft records.

**Details** Exact vulnerable source path: ` packages/apostrophe/modules/@apostrophecms/i18n/index.js:503-529` Exact API route:` POST /api/v1/@apostrophecms/i18n/exist-in-locale` The handler verifies only that the requester is authenticated:

``` if (!req.user) { throw self.apos.error('notfound'); } ``` It then performs a direct database lookup using attacker-controlled document IDs, locale, and mode:

``` const found = await self.apos.doc.db.find({ aposLocale: `${locale}:${mode}`, aposDocId: { $in: ids.map(self.apos.doc.toAposDocId) } }).project({ _id: 1, aposDocId: 1 }).toArray(); ``` This query does not apply:

.permission('view') .permission('edit') apos.permission.criteria(req, 'view') object-level document authorization locale-specific authorization

The endpoint accepts multiple IDs, making bulk probing possible.

**Proof of Concept**

The local application was running at: http://127.0.0.1:3000 The test account had the low-privilege role: guest The local databa…