https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 21 Oct 2026 07:31:21 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-113660 <p>ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, ApostropheCMS’s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mode, including draft mode. The endpoint returns localized document identifiers without applying document-level view or edit authorization criteria. This issue is fixed in version 4.33.0.</p> <p>ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, ApostropheCMS’s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mode, including draft mode. The endpoint returns localized document identifiers without applying document-level view or edit authorization criteria. This issue is fixed in version 4.33.0.</p> https://db.gcve.eu/vuln/fkie_cve-2026-113660 https://db.gcve.eu/vuln/ghsa-vmxh-77cw-65j7 <p><strong>Affected:</strong> npm: apostrophe</p> <p>**Summary** ApostropheCMS’s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mode, including draft mode. The endpoint returns localized document identifiers without applying document-level view or edit authorization criteria.</p> <p>The issue was reproduced against a real local ApostropheCMS application running the reviewed source code. The test used a synthetic guest account and synthetic restricted draft records.</p> <p>**Details** Exact vulnerable source path: ` packages/apostrophe/modules/@apostrophecms/i18n/index.js:503-529` Exact API route:` POST /api/v1/@apostrophecms/i18n/exist-in-locale` The handler verifies only that the requester is authenticated:</p> <p>``` if (!req.user) { throw self.apos.error(&#39;notfound&#39;); } ``` It then performs a direct database lookup using attacker-controlled document IDs, locale, and mode:</p> <p>``` const found = await self.apos.doc.db.find({ aposLocale: `${locale}:${mode}`, aposDocId: { $in: ids.map(self.apos.doc.toAposDocId) } }).project({ _id: 1, aposDocId: 1 }).toArray(); ``` This query does not apply:</p> <p>.permission(&#39;view&#39;) .permission(&#39;edit&#39;) apos.permission.criteria(req, &#39;view&#39;) object-level document authorization locale-specific authorization</p> <p>The endpoint accepts multiple IDs, making bulk probing possible.</p> <p>**Proof of Concept**</p> <p>The local application was running at: http://127.0.0.1:3000 The test account had the low-privilege role: guest The local databa…</p> <p><strong>Affected:</strong> npm: apostrophe</p> <p>**Summary** ApostropheCMS’s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mode, including draft mode. The endpoint returns localized document identifiers without applying document-level view or edit authorization criteria.</p> <p>The issue was reproduced against a real local ApostropheCMS application running the reviewed source code. The test used a synthetic guest account and synthetic restricted draft records.</p> <p>**Details** Exact vulnerable source path: ` packages/apostrophe/modules/@apostrophecms/i18n/index.js:503-529` Exact API route:` POST /api/v1/@apostrophecms/i18n/exist-in-locale` The handler verifies only that the requester is authenticated:</p> <p>``` if (!req.user) { throw self.apos.error(&#39;notfound&#39;); } ``` It then performs a direct database lookup using attacker-controlled document IDs, locale, and mode:</p> <p>``` const found = await self.apos.doc.db.find({ aposLocale: `${locale}:${mode}`, aposDocId: { $in: ids.map(self.apos.doc.toAposDocId) } }).project({ _id: 1, aposDocId: 1 }).toArray(); ``` This query does not apply:</p> <p>.permission(&#39;view&#39;) .permission(&#39;edit&#39;) apos.permission.criteria(req, &#39;view&#39;) object-level document authorization locale-specific authorization</p> <p>The endpoint accepts multiple IDs, making bulk probing possible.</p> <p>**Proof of Concept**</p> <p>The local application was running at: http://127.0.0.1:3000 The test account had the low-privilege role: guest The local databa…</p> https://db.gcve.eu/vuln/ghsa-vmxh-77cw-65j7