CVE-2026-113668

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the REST route GET /api/v1//:id/locales and the equivalent page route does not apply the publicApiCheckAsync gate that ApostropheCMS's other read routes enforce. An unauthenticated caller can therefore query this...

ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)

Summary The REST route GET /api/v1//:id/locales and the equivalent page route does not apply the publicApiCheckAsync gate that ApostropheCMS's other read routes enforce. An unauthenticated caller can therefore query this route for any document id and learn whether the document exists and which...

GHSA-GQH3-7856-RJJG ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)

Summary The REST route GET /api/v1//:id/locales and the equivalent page route does not apply the publicApiCheckAsync gate that ApostropheCMS's other read routes enforce. An unauthenticated caller can therefore query this route for any document id and learn whether the document exists and which...

CVE-2026-113668

ApostropheCMS , an open-source Node.js content management system, contains a vulnerability in versions prior to 4.33.0 . The REST route GET /api/v1//:_id/locales (along with its equivalent page route) fails to apply the publicApiCheckAsync gate used by other read routes. This omission allows an u...

CVE-2026-113668 ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the REST route GET /api/v1//:id/locales and the equivalent page route does not apply the publicApiCheckAsync gate that ApostropheCMS's other read routes enforce. An unauthenticated caller can therefore query this...

CVE-2026-113668

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the REST route GET /api/v1//:id/locales and the equivalent page route does not apply the publicApiCheckAsync gate that ApostropheCMS's other read routes enforce. An unauthenticated caller can therefore query this...

PT-2026-118583

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.33.0 Description The REST endpoints 'GET /api/v1//: id/locales' and 'GET /api/v1/@apostrophecms/page/: id/locales' fail to apply the publicApiCheckAsync authorization gate used by other read routes. This allow...