CVE-2026-113668: 
JavaScript vulnerability analysis and mitigation

CVE-2026-113668 is an information disclosure vulnerability in ApostropheCMS, an open-source Node.js content management system. The REST routes GET /api/v1/<piece-type>/:_id/locales and GET /api/v1/@apostrophecms/page/:_id/locales fail to enforce the publicApiCheckAsync authorization gate that all other read routes in the framework apply, allowing unauthenticated callers to determine document existence and enumerate locale/publication metadata for any document by ID. All versions of the apostrophe npm package prior to 4.33.0 are affected. The vulnerability was reported by Santosh Kumar Puppala and thota murari, published to the GitHub Advisory Database on October 20, 2026, and carries a CVSS v3.1 base score of 5.3 (Medium) (Github Advisory).

The root cause is a missing authorization check (CWE-862) leading to exposure of sensitive information to unauthorized actors (CWE-200). In modules/@apostrophecms/piece-type/index.js at line 397, the :_id/locales route is registered without calling publicApiCheckAsync, and the same omission exists in modules/@apostrophecms/page/index.js at line 925. Sibling read routes in the same modules (e.g., getAll at piece-type/index.js:256-263) correctly invoke publicApiCheckAsync to enforce the public-API access policy, but the locales handler bypasses this gate entirely. An unauthenticated attacker with knowledge of a document _id can send a simple HTTP GET request to either endpoint and receive locale and publication state metadata that the read API is otherwise designed to restrict. Additionally, apos.doc.getLocales() did not apply document-level view permissions, meaning draft locales of document types restricted by viewRole could also be disclosed (Github Advisory, Security Fix Commit).

Successful exploitation allows an unauthenticated remote attacker to confirm the existence of any document by its _id and enumerate which locales it is published in, including draft locales that may be restricted by viewRole for logged-in users. This constitutes a confidentiality breach limited to metadata — no document content is directly exposed — but the information can be used for reconnaissance, content mapping, or to infer the structure and publishing state of a CMS-managed site. There is no impact on integrity or availability (Github Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of active in-the-wild exploitation as of the disclosure date (Github Advisory). The vulnerability is automatable (no user interaction or privileges required), but exploitation requires the attacker to already possess a valid document _id, which is an opaque identifier that somewhat raises the practical attack complexity. The EPSS score is 0.0, and the CVE status is listed as "Deferred" with no CISA KEV catalog entry. No threat actor attribution has been reported.

1. Reconnaissance: Identify an ApostropheCMS instance running a version prior to 4.33.0 by examining HTTP response headers, page source, or npm package metadata exposed by the application.
2. Obtain a document _id: Gather document IDs through any available means — e.g., from publicly visible API responses, page source HTML, or by querying other unauthenticated endpoints that may leak IDs (such as public piece listings).
3. Query the locales endpoint: Send an unauthenticated HTTP GET request to GET /api/v1/<piece-type>/<_id>/locales or GET /api/v1/@apostrophecms/page/<_id>/locales, substituting the target piece type slug and document ID.
4. Analyze the response: If the document exists, the server returns locale and publication state metadata (e.g., which locales the document is published in, including draft locales), confirming document existence and revealing publishing structure without any authentication (Github Advisory).

• Network: Unusual or repeated unauthenticated HTTP GET requests to paths matching /api/v1/*/locales or /api/v1/@apostrophecms/page/*/locales from external IP addresses, especially in bulk or automated patterns.
• Logs: Web server or Express access logs showing 200 responses to GET /api/v1/<piece-type>/<_id>/locales or GET /api/v1/@apostrophecms/page/<_id>/locales from unauthenticated sessions (no session cookie or bearer token present).
• Logs: High volume of requests to the locales endpoints with varying _id values, suggesting enumeration attempts.

Upgrade the apostrophe npm package to version 4.33.0 or later, which adds the publicApiCheckAsync gate to the :_id/locales route in both the piece-type and page modules, and also applies document-level view permissions within apos.doc.getLocales() (Github Advisory, Release 4.33.0). As a temporary workaround for sites that cannot immediately upgrade, restrict network access to the GET /api/v1/*/locales endpoints at the reverse proxy or API gateway level, or implement authentication gating at that layer to block unauthenticated requests to those paths.

The vulnerability was responsibly disclosed by security researchers Santosh Kumar Puppala and thota murari, who are credited in the official GitHub Security Advisory. The ApostropheCMS maintainer (boutell) published the advisory and released the fix as part of a broader security update (commit f84fd41) that addressed multiple vulnerabilities simultaneously in version 4.33.0 (Security Fix Commit). No significant broader media coverage or social media discussion has been identified.