{"id":"EUVD-2026-105216","enisaUuid":"b9180e8b-d198-3b0b-94d6-fb485fffeea5","description":"ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the REST route GET /api/v1/\u003cpiece-type\u003e/:_id/locales (and the equivalent page route) does not apply the publicApiCheckAsync gate that ApostropheCMS\u0027s other read routes enforce. An unauthenticated caller can therefore query this route for any document _id and learn whether the document exists and which locales it is published in — a document-existence and locale-metadata disclosure that the read-API is otherwise supposed to gate. This issue is fixed in version 4.33.0.","datePublished":"Oct 20, 2026, 5:32:07 PM","dateUpdated":"Oct 20, 2026, 7:04:47 PM","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-gqh3-7856-rjjg\nhttps://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce\nhttps://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350\nhttps://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0\n","aliases":"CVE-2026-113668\nGHSA-gqh3-7856-rjjg\n","assigner":"GitHub_M","epss":0.32,"enisaIdProduct":[{"id":"b36a3c92-689d-3926-83af-79acb8a713f6","product":{"name":"Apostrophe ","vendor":{"name":"apostrophecms"}},"product_version":"\u003c 4.33.0"}],"enisaIdVendor":[{"id":"6f7676ac-61b3-3569-b7fb-883b08b62462","vendor":{"name":"apostrophecms"}}],"enisaIdVulnerability":[{"id":"521ca0d8-eff8-36f7-9bd6-6a97be89810f","vulnerability":{"id":"GHSA-gqh3-7856-rjjg","description":"ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)","datePublished":"Oct 20, 2026, 6:14:32 PM","dateUpdated":"Oct 20, 2026, 6:14:33 PM","baseScore":0.0,"references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-gqh3-7856-rjjg\nhttps://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce\nhttps://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350\nhttps://github.com/apostrophecms/apostrophe\nhttps://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0\n","enisa_id":"EUVD-2026-105216\n","aliases":"CVE-2026-113668\nGHSA-gqh3-7856-rjjg\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:08:27 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"898d2368-1426-36b1-a60b-22fcbde0a69a","vulnerability":{"id":"CVE-2026-113668","description":"ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the REST route GET /api/v1/\u003cpiece-type\u003e/:_id/locales (and the equivalent page route) does not apply the publicApiCheckAsync gate that ApostropheCMS\u0027s other read routes enforce. An unauthenticated caller can therefore query this route for any document _id and learn whether the document exists and which locales it is published in — a document-existence and locale-metadata disclosure that the read-API is otherwise supposed to gate. This issue is fixed in version 4.33.0.","datePublished":"Oct 20, 2026, 5:32:07 PM","dateUpdated":"Oct 20, 2026, 7:04:47 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-gqh3-7856-rjjg\nhttps://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce\nhttps://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350\nhttps://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0\n","enisa_id":"EUVD-2026-105216\n","assigner":"GitHub_M","epss":0.32,"dataProcessed":"Nov 4, 2026, 7:14:20 AM","vulnerabilityProduct":[{"id":"76ac7c0c-72e8-3164-b553-89dfa2c12840","product":{"name":"Apostrophe ","vendor":{"name":"apostrophecms"}},"product_version":"\u003c 4.33.0"}],"vulnerabilityVendor":[{"id":"214dd73f-5dbb-3410-b9a4-2c3b86327128","vendor":{"name":"apostrophecms"}}]}}],"enisaIdAdvisory":[]}