## ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers

- 種別: advisory
- 重大度: medium
- 関連技術: nodejs
- CVE: CVE-2026-113660
- 公開日時: 2026-10-20T18:19:34.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-vmxh-77cw-65j7)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-vmxh-77cw-65j7

影響: npm:apostrophe < 4.33.0 → 4.33.0
Summary ApostropheCMS’s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mode, including draft mode. The endpoint returns localized document identifiers without applying document-level view or edit authorization criteria. The issue was reproduced against a real local ApostropheCMS application running the reviewed source code. The test used a synthetic guest account and synthetic restricted draft records. Det…