---
id: "CVE-2026-113668"
kind: "vulnerability"
aliases: ["CVE-2026-113668", "GHSA-gqh3-7856-rjjg"]
title: "ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)"
severity: "medium"
cvss: 5.300000190734863
epss: 0.003220000071451068
exploited: false
status: "open"
category: "package"
products: [{"name": "apostrophe", "fixed": ["4.33.0"], "affected": "< 4.33.0", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["apostrophe", "cwe-200", "cwe-862", "headless-cms", "node.js", "package", "self-hosted"]
not_affected_if: ["no-public-api-exposure", "version-4.33.0-or-later"]
published_at: "2026-10-20T18:14:32+00:00"
first_seen_at: "2026-10-23T19:11:32+00:00"
updated_at: "2026-10-23T19:58:22+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-gqh3-7856-rjjg", "first_seen_at": "2026-10-23T19:11:32+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113668", "first_seen_at": "2026-10-23T21:57:21+00:00"}]
---

# ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)

The ApostropheCMS REST route GET /api/v1/<piece-type>/:_id/locales (and the page equivalent) skips the public-API authorization check that sibling read routes apply. An unauthenticated caller who knows a document _id can learn whether the document exists and which locales it is published in.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:apostrophe affected < 4.33.0 fixed 4.33.0

## How to check

Check the installed apostrophe version with: npm ls apostrophe
If below 4.33.0, send an unauthenticated GET to /api/v1/<piece-type>/<known-_id>/locales on a site with public-API access restricted and see if it returns locale data.

## Fix

Upgrade the apostrophe npm package to 4.33.0 or later.
Until then, unknown whether a configuration workaround exists.

## Timeline

- 2026-10-23T19:11:32+00:00 ghsa https://github.com/advisories/GHSA-gqh3-7856-rjjg
- 2026-10-23T21:57:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113668

## From the sources

## Summary
The REST route `GET /api/v1/<piece-type>/:_id/locales` (and the equivalent page route) does not apply the `publicApiCheckAsync` gate that ApostropheCMS's other read routes enforce. An unauthenticated caller can therefore query this route for any document `_id` and learn whether the document exists and which locales it is published in — a document-existence and locale-metadata disclosure that the read-API is otherwise supposed to gate.
 
## Affected
- Repository: `apostrophecms/apostrophe` (monorepo package `apostrophe`).
- Confirmed at **4.32.2** (commit `d3ff8c9` == the shipped 4.32.2; unchanged at current HEAD). No fix at time of report.
- Stack: Node.js / Express + MongoDB.
- Endpoints: `GET /api/v1/<piece-type>/:_id/locales` and `GET /api/v1/@apostrophecms/page/:_id/locales`.

## Technical detail
- Unsafe: `modules/@apostrophecms/piece-type/index.js:397` registers the `:_id/locales` route with **no** `publicApiCheckAsync`. The page module has the same omission at `modules/@apostrophecms/page/index.js:925`.
- Gated siblings: the read routes in the same module (e.g. `getAll` at `piece-type/index.js:256-263`) call `publicApiCheckAsync` (`:263`) to enforce the public-API access policy.
- So the `locales` handler (which calls `getLocales()` for the document) runs for any caller regardless of the public-API gate the other read routes apply, returning the document's locale/publication metadata without authorization.

## Impact

An unauthenticated caller can confirm the existence of a document by `_id` and enumerate its locales/publication state — information the read-API is meant to gate. Defensibly 4.3 (AC:H) given the opaque `_id` precondition (the caller needs a document id).
 
## How it was verified (local only)
Reproduced against `apostrophe@4.32.2` (== commit `d3ff8c9`) locally with synthetic content:
- Source review confirmed the `:_id/locales` route lacks `publicApiCheckAsync` while the sibling read routes have it.
- An **unauthenticated** `GET /api/v1/<piece-type>/<_id>/locales` returned the document's locale metadata (existence + locales), while the gated read routes (e.g. `getAll`) correctly required the public-API policy.
- Control: the same route with the `publicApiCheckAsync` gate added (matching the siblings) denies the unauthenticated request — isolating the missing gate as the cause.
Synthetic content only; nothing hosted was touched.
 
## Remediation
Add the `publicApiCheckAsync` (or equivalent) authorization gate to the `:_id/locales` route in both the piece-type and page modules, matching the sibling read routes, so the locale/existence metadata is only returned to callers permitted by the public-API policy.
 
## Credit
Please credit **Santosh Kumar Puppala** (https://github.com/Santoshkumarpuppala).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_