ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers

影響: npm:apostrophe < 4.33.0 → 4.33.0

ApostropheCMS’s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mode, including draft mode. The endpoint returns localized document identifiers without applying document-level view or edit authorization criteria. The issue was reproduced against a real local ApostropheCMS application running the reviewed source code. The test used a synthetic guest account and synthetic restricted draft records. Det…

Read on GitHub Advisory Database

On 10/21/2026, 03:19 AM, GitHub Advisory Database published "ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers" (type: Advisory). Severity is "Medium" (medium). Related technologies: JavaScript / Node.js. CVE: CVE-2026-113660.