CVE-2026-113660

Published: Ott 20, 2026 Last Modified: Ott 20, 2026

ExploitDB:

Other exploit source:

Google Dorks:

MEDIUM 4,3

Source: [email protected]

Attack Vector: network

Attack Complexity: low

Privileges Required: low

User Interaction: none

Scope: unchanged

Confidentiality: low

Integrity: none

Availability: none

Description

AI Translation Available

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, ApostropheCMS’s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mode, including draft mode. The endpoint returns localized document identifiers without applying document-level view or edit authorization criteria. This issue is fixed in version 4.33.0.

862

Missing Authorization

Incomplete

Abstraction: Class Structure: Simple

Common Consequences

Security Scopes Affected:

Confidentiality Integrity Access Control Availability

Potential Impacts:

Read Application Data Read Files Or Directories Modify Application Data Modify Files Or Directories Gain Privileges Or Assume Identity Bypass Protection Mechanism Dos: Crash, Exit, Or Restart Dos: Resource Consumption (Cpu) Dos: Resource Consumption (Memory) Dos: Resource Consumption (Other)

Applicable Platforms

Technologies: AI/ML, Web Server, Database Server, Not Technology-Specific

Likelihood of Exploit: High

View CWE Details

https://github.com/apostrophecms/apostrophe/security/adviso…

https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vmxh-77cw-…

https://github.com/apostrophecms/apostrophe/commit/9500b8b0…

https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c2…

https://github.com/apostrophecms/apostrophe/commit/f84fd41c…

https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25…

https://github.com/apostrophecms/apostrophe/releases/tag/ap…

https://github.com/apostrophecms/apostrophe/releases/tag/[email protected]