CVE-2026-113660

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.33.0

Description An issue in the exist-in-locale API allows an authenticated low-privilege user to determine if restricted documents exist in a specific locale and mode, including draft mode. The endpoint returns localized document identifiers without applying document-level view or edit authorization criteria, effectively acting as an existence oracle. This allows an attacker to probe arbitrary document base IDs, identify unpublished draft versions, and perform bulk reconnaissance by submitting multiple IDs in a single request.

API Endpoint: POST /api/v1/@apostrophecms/i18n/exist-in-locale Vulnerable Parameters: ids, locale, and mode

Recommendations Update to version 4.33.0. As a temporary workaround, restrict access to the POST /api/v1/@apostrophecms/i18n/exist-in-locale endpoint to only highly privileged users.