5 matches found
CVE-2026-113668
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the REST route GET /api/v1//:id/locales and the equivalent page route does not apply the publicApiCheckAsync gate that ApostropheCMS's other read routes enforce. An unauthenticated caller can therefore query this...
GHSA-GQH3-7856-RJJG ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)
Summary The REST route GET /api/v1//:id/locales and the equivalent page route does not apply the publicApiCheckAsync gate that ApostropheCMS's other read routes enforce. An unauthenticated caller can therefore query this route for any document id and learn whether the document exists and which...
ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)
Summary The REST route GET /api/v1//:id/locales and the equivalent page route does not apply the publicApiCheckAsync gate that ApostropheCMS's other read routes enforce. An unauthenticated caller can therefore query this route for any document id and learn whether the document exists and which...
CVE-2026-113668
ApostropheCMS , an open-source Node.js content management system, contains a vulnerability in versions prior to 4.33.0 . The REST route GET /api/v1//:_id/locales (along with its equivalent page route) fails to apply the publicApiCheckAsync gate used by other read routes. This omission allows an u...
CVE-2026-113668 ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the REST route GET /api/v1//:id/locales and the equivalent page route does not apply the publicApiCheckAsync gate that ApostropheCMS's other read routes enforce. An unauthenticated caller can therefore query this...