CVE-2026-113668 · GHSA-gqh3-7856-rjjg

ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)

Risk score: 42/100
CVSS: 5.3 v3.1
Exploit chance (30 days): 0.3%
Published: 20 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the REST route GET /api/v1/<piece-type>/:_id/locales (and the equivalent page route) does not apply the publicApiCheckAsync gate that ApostropheCMS's other read routes enforce. An unauthenticated caller can therefore query this route f…
Affected: apostrophe (npm) < 4.33.0
Fix: Upgrade apostrophe to 4.33.0 or later.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

apostrophe: Amber, patch this week. ApostropheCMS has a vulnerability that allows unauthenticated requests to perform upload initialization, chunk storage, and temporary processing, leading to resource exhaustion. An attacker could exploit this to exhaust system resources.

The flaws

CVE-2026-113668: ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure) (CVSS 5.3 · EPSS 0%)
CVE-2026-113711: ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export (CVSS 7.5 · EPSS 1%)
CVE-2026-113658: ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory (CVSS 7.5 · EPSS 1%)
CVE-2026-113653: ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public) (CVSS 6.9 · EPSS 0%)

The fix

Upgrade apostrophe: 4.33.0 or later on your release line

Who is exposed: {'products': ['ApostropheCMS'], 'packages': [{'ecosystem': 'npm', 'name': 'apostrophe', 'vulnerable': '< 4.33.0', 'patched': '4.33.0'}, {'ecosystem': 'npm', 'name': '@apostrophecms/import-export', 'vulnerable': '< 3.7.0', 'patched': '3.7.0'}]}

Where it stands

Public proof of concept

Connects to

Same weakness: Information disclosure (CWE-200). 197 other warnings in 30 days

Why it is Yellow

CVSS 5.3 medium
On your watchlist: npm

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
apostrophe	npm	< 4.33.0	4.33.0

References

Original description

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the REST route GET /api/v1/<piece-type>/:_id/locales (and the equivalent page route) does not apply the publicApiCheckAsync gate that ApostropheCMS's other read routes enforce. An unauthenticated caller can therefore query this route for any document _id and learn whether the document exists and which locales it is published in — a document-existence and locale-metadata disclosure that the read-API is otherwise supposed to gate. This issue is fixed in version 4.33.0.

Last activity 20 Oct 2026. Patch Forecast updates every hour.