Unauthenticated Route Exposure in ApostropheCMS Impacting Document Metadata

CVE-2026-113668

What is CVE-2026-113668?

ApostropheCMS is an open-source Node.js content management system that is affected by a vulnerability in versions prior to 4.33.0. Specifically, the issue arises in the REST route GET /api/v1//:_id/locales, which lacks the publicApiCheckAsync gate that is enforced on other read routes. This absence allows an unauthenticated attacker to query any document _id, revealing whether the document exists and the locales in which it is published. Such information can expose sensitive metadata that should otherwise remain secure. This vulnerability is addressed in version 4.33.0.

References