https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 22 Oct 2026 22:02:49 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-113668 <p>ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the REST route GET /api/v1/&lt;piece-type&gt;/:_id/locales (and the equivalent page route) does not apply the publicApiCheckAsync gate that ApostropheCMS&#39;s other read routes enforce. An unauthenticated caller can therefore query this route for any document _id and learn whether the document exists and which locales it is published in — a document-existence and locale-metadata disclosure that the read-API is otherwise supposed to gate. This issue is fixed in version 4.33.0.</p> <p>ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the REST route GET /api/v1/&lt;piece-type&gt;/:_id/locales (and the equivalent page route) does not apply the publicApiCheckAsync gate that ApostropheCMS&#39;s other read routes enforce. An unauthenticated caller can therefore query this route for any document _id and learn whether the document exists and which locales it is published in — a document-existence and locale-metadata disclosure that the read-API is otherwise supposed to gate. This issue is fixed in version 4.33.0.</p> https://db.gcve.eu/vuln/fkie_cve-2026-113668 https://db.gcve.eu/vuln/ghsa-gqh3-7856-rjjg <p><strong>Affected:</strong> npm: apostrophe</p> <p>## Summary The REST route `GET /api/v1/&lt;piece-type&gt;/:_id/locales` (and the equivalent page route) does not apply the `publicApiCheckAsync` gate that ApostropheCMS&#39;s other read routes enforce. An unauthenticated caller can therefore query this route for any document `_id` and learn whether the document exists and which locales it is published in — a document-existence and locale-metadata disclosure that the read-API is otherwise supposed to gate. ## Affected - Repository: `apostrophecms/apostrophe` (monorepo package `apostrophe`). - Confirmed at **4.32.2** (commit `d3ff8c9` == the shipped 4.32.2; unchanged at current HEAD). No fix at time of report. - Stack: Node.js / Express + MongoDB. - Endpoints: `GET /api/v1/&lt;piece-type&gt;/:_id/locales` and `GET /api/v1/@apostrophecms/page/:_id/locales`.</p> <p>## Technical detail - Unsafe: `modules/@apostrophecms/piece-type/index.js:397` registers the `:_id/locales` route with **no** `publicApiCheckAsync`. The page module has the same omission at `modules/@apostrophecms/page/index.js:925`. - Gated siblings: the read routes in the same module (e.g. `getAll` at `piece-type/index.js:256-263`) call `publicApiCheckAsync` (`:263`) to enforce the public-API access policy. - So the `locales` handler (which calls `getLocales()` for the document) runs for any caller regardless of the public-API gate the other read routes apply, returning the document&#39;s locale/publication metadata without authorization.</p> <p>## Impact</p> <p>An unauthenticated caller can confirm t…</p> <p><strong>Affected:</strong> npm: apostrophe</p> <p>## Summary The REST route `GET /api/v1/&lt;piece-type&gt;/:_id/locales` (and the equivalent page route) does not apply the `publicApiCheckAsync` gate that ApostropheCMS&#39;s other read routes enforce. An unauthenticated caller can therefore query this route for any document `_id` and learn whether the document exists and which locales it is published in — a document-existence and locale-metadata disclosure that the read-API is otherwise supposed to gate. ## Affected - Repository: `apostrophecms/apostrophe` (monorepo package `apostrophe`). - Confirmed at **4.32.2** (commit `d3ff8c9` == the shipped 4.32.2; unchanged at current HEAD). No fix at time of report. - Stack: Node.js / Express + MongoDB. - Endpoints: `GET /api/v1/&lt;piece-type&gt;/:_id/locales` and `GET /api/v1/@apostrophecms/page/:_id/locales`.</p> <p>## Technical detail - Unsafe: `modules/@apostrophecms/piece-type/index.js:397` registers the `:_id/locales` route with **no** `publicApiCheckAsync`. The page module has the same omission at `modules/@apostrophecms/page/index.js:925`. - Gated siblings: the read routes in the same module (e.g. `getAll` at `piece-type/index.js:256-263`) call `publicApiCheckAsync` (`:263`) to enforce the public-API access policy. - So the `locales` handler (which calls `getLocales()` for the document) runs for any caller regardless of the public-API gate the other read routes apply, returning the document&#39;s locale/publication metadata without authorization.</p> <p>## Impact</p> <p>An unauthenticated caller can confirm t…</p> https://db.gcve.eu/vuln/ghsa-gqh3-7856-rjjg