CVE-2026-113660 · GHSA-vmxh-77cw-65j7
ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers
- Risk score
- 42/100
- CVSS
- 4.3 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 20 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, ApostropheCMS’s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mode, including draft mode. The endpoint returns localized document identifiers wi…
- Affected
- apostrophe (npm) < 4.33.0
- Fix
- Upgrade apostrophe to 4.33.0 or later.
- Exploitation
- Public proof of concept
Why it is Yellow
- CVSS 4.3 medium
- Public exploit or proof of concept referenced
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| apostrophe | npm | < 4.33.0 | 4.33.0 |
References
- https://github.com/advisories/GHSA-vmxh-77cw-65j7
- https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vmxh-77cw-65j7
- https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce
- https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350
- https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0
- https://github.com/advisories/GHSA-vmxh-77cw-65j7
Original description
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, ApostropheCMS’s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mode, including draft mode. The endpoint returns localized document identifiers without applying document-level view or edit authorization criteria. This issue is fixed in version 4.33.0.
Last activity 20 Oct 2026. Patch Forecast updates every hour.