Information Disclosure in ApostropheCMS Open Source Node.js Content Management System
CVE-2026-113660

4.3MEDIUM

Key Information:

Vendor: Apostrophecms
Status: Apostrophe
Vendor: CVE Published:; 20 October 2026

🔔 Create Apostrophecms Vulnerability Alert

What is CVE-2026-113660?

ApostropheCMS, a widely used open-source Node.js content management system, faces a significant vulnerability where authenticated low-privilege users can exploit the exist-in-locale API. This flaw allows these users to ascertain the existence of restricted documents within specified locales and draft modes without appropriate authorization checks. The API unwittingly returns localized document identifiers without enforcing view or edit permissions, leading to unintentional exposure of sensitive information. This vulnerability was addressed and remediated in version 4.33.0.