CVE-2026-113668

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.33.0

Description The REST endpoints 'GET /api/v1//: id/locales' and 'GET /api/v1/@apostrophecms/page/: id/locales' fail to apply the publicApiCheckAsync authorization gate used by other read routes. This allows an unauthenticated caller to query the id variable of any document to determine if the document exists and identify the locales in which it is published, resulting in the disclosure of document existence and locale metadata.

Recommendations Update to version 4.33.0. As a temporary workaround, restrict access to the 'GET /api/v1//: id/locales' and 'GET /api/v1/@apostrophecms/page/: id/locales' endpoints to minimize the risk of metadata disclosure.