npm: ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)

npm: ApostropheCMS: :id/locales REST route omits the public-API authorization gate its sibling read routes enforce unauthenticated doc-existence + locale metadata disclosure vulnerability discovered by ? in WordPress npm apostrophe versions 4.33.0...