{"id":"EUVD-2026-105208","enisaUuid":"818c54c4-2321-3c8a-86b4-fe03eb720c3f","description":"ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, ApostropheCMS’s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mode, including draft mode. The endpoint returns localized document identifiers without applying document-level view or edit authorization criteria. This issue is fixed in version 4.33.0.","datePublished":"Oct 20, 2026, 5:04:06 PM","dateUpdated":"Oct 20, 2026, 5:43:51 PM","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vmxh-77cw-65j7\nhttps://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce\nhttps://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350\nhttps://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0\n","aliases":"CVE-2026-113660\nGHSA-vmxh-77cw-65j7\n","assigner":"GitHub_M","epss":0.36,"enisaIdProduct":[{"id":"9a081bb5-f869-3b84-a331-1354e73a14da","product":{"name":"Apostrophe ","vendor":{"name":"apostrophecms"}},"product_version":"\u003c 4.33.0"}],"enisaIdVendor":[{"id":"0e7d9c4c-6c83-3f02-8c9d-9b90a3a3fc53","vendor":{"name":"apostrophecms"}}],"enisaIdVulnerability":[{"id":"26ea7c68-cc33-3427-a244-acecf615df4b","vulnerability":{"id":"GHSA-vmxh-77cw-65j7","description":"ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers","datePublished":"Oct 20, 2026, 6:19:34 PM","dateUpdated":"Oct 20, 2026, 6:19:34 PM","baseScore":0.0,"references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vmxh-77cw-65j7\nhttps://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce\nhttps://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350\nhttps://github.com/apostrophecms/apostrophe\nhttps://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0\n","enisa_id":"EUVD-2026-105208\n","aliases":"GHSA-vmxh-77cw-65j7\nCVE-2026-113660\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:08:27 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"58d69259-e5fb-3232-82d0-e384aa5f2027","vulnerability":{"id":"CVE-2026-113660","description":"ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, ApostropheCMS’s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mode, including draft mode. The endpoint returns localized document identifiers without applying document-level view or edit authorization criteria. This issue is fixed in version 4.33.0.","datePublished":"Oct 20, 2026, 5:04:06 PM","dateUpdated":"Oct 20, 2026, 5:43:51 PM","status":"PUBLISHED","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vmxh-77cw-65j7\nhttps://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce\nhttps://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350\nhttps://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0\n","enisa_id":"EUVD-2026-105208\n","assigner":"GitHub_M","epss":0.36,"dataProcessed":"Nov 2, 2026, 7:15:26 AM","vulnerabilityProduct":[{"id":"50bb9f33-5f7c-30c7-a1ea-f0919a3a8edb","product":{"name":"Apostrophe ","vendor":{"name":"apostrophecms"}},"product_version":"\u003c 4.33.0"}],"vulnerabilityVendor":[{"id":"87a635ca-b2b1-398d-ad4c-fda4a555072a","vendor":{"name":"apostrophecms"}}]}}],"enisaIdAdvisory":[]}