CVE-2026-113660: ApostropheCMS Authenticated Object-Level Authorization Bypass in exist-in-locale
Summary
CVE-2026-113660: Summary ApostropheCMS’s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mode, including draft mode. Affects apostrophe versions < 4.33.0. Fixed in 4.33.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
ApostropheCMS is an open-source content management system (CMS) designed for building websites and applications. It provides a flexible framework for managing content, including support for multiple languages and localization. The system allows users to create, edit, and manage documents, but it has a vulnerability that permits low-privilege authenticated users to bypass authorization checks on localized draft documents.
Vulnerability Detail
The vulnerability in ApostropheCMS arises from its exist-in-locale API, which allows authenticated users with low privileges to determine the existence of restricted documents in specific locales and modes, including draft mode. The API does not enforce document-level view or edit permissions, leading to unauthorized access to localized document identifiers. This flaw can be exploited by attackers to probe for restricted documents, identify unpublished drafts, and perform bulk enumeration of document IDs, potentially exposing sensitive information about the application's content structure.
How To Fix
Latest published version: 4.34.0 as of 23 Oct 2026
npm install apostrophe@4.34.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.33.0
This is the first release that contains the fix.
npm install apostrophe@4.33.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the exist-in-locale API endpoint by implementing additional authentication checks or by limiting access to trusted users until the package can be updated.
Conclusion
CVE-2026-113660 is a significant vulnerability in ApostropheCMS that allows low-privilege users to bypass authorization checks on localized draft documents. It is crucial to update to version 4.33.0 or later to mitigate this risk and protect sensitive content. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for apostrophe →
FAQ
CVE-2026-113660 is a vulnerability in ApostropheCMS that allows low-privilege authenticated users to bypass authorization checks and access restricted localized draft identifiers.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your package-lock.json without any signup.
The vulnerability allows attackers to probe for restricted documents, identify unpublished drafts, and obtain exact localized document identifiers, which could lead to unauthorized information disclosure.
Yes, a patch is available in version 4.33.0 of ApostropheCMS. Updating to this version will resolve the vulnerability.
If immediate updating is not possible, consider implementing additional access controls or monitoring to limit exposure until the patch can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for apostrophe.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
