CVE-2026-113660— ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers
Quick assessment
Affected
apostrophecms apostrophe
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
ApostropheCMS 是一个开源的基于 Node.js 的内容管理系统。在 4.33.0 版本之前，ApostropheCMS 的 API 允许已认证的低权限用户判断受限文档是否存在于指定的语言环境（locale）和模式（包括草稿模式）中。该端点在返回本地化的文档标识符时，未应用文档级别的查看或编辑授权规则。此问题已在 4.33.0 版本中修复。
Possible ATT&CK Techniques 1 AI
T1086
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-113660
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers
Source: CVE Program / CVE List V5
Vulnerability Description
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, ApostropheCMS’s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mode, including draft mode. The endpoint returns localized document identifiers without applying document-level view or edit authorization criteria. This issue is fixed in version 4.33.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| apostrophecms | apostrophe | < 4.33.0 | - |
|
II. Public POCs for CVE-2026-113660
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-113660
请登录查看更多情报信息。
Other References for CVE-2026-113660 (4)
Same Patch Batch · apostrophecms · 2026-10-20 · 33 CVEs total
| CVE-2026-113658 | 7.5 HIGH | ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system te |
| CVE-2026-113711 | 7.5 HIGH | ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing i |
| CVE-2026-113666 | 7.1 HIGH | ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophe |
| CVE-2026-113653 | 6.9 MEDIUM | ApostropheCMS: The general public can access @apostrophecms/user objects via a relationshi |
| CVE-2026-112956 | 6.5 MEDIUM | ApostropheCMS: Archive duplicate continuation lets contributors overwrite published conten |
| CVE-2026-112955 | 6.5 MEDIUM | ApostropheCMS: Import archives can exhaust server storage and deny service |
| CVE-2026-113649 | 6.5 MEDIUM | ApostropheCMS: Import API bypasses publication roles for protected content |
| CVE-2026-113659 | 6.1 MEDIUM | ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-base |
| CVE-2026-112953 | 6.0 MEDIUM | ApostropheCMS: Exposure of Sensitive Information via predictable export filenames |
| CVE-2026-113710 | 5.9 MEDIUM | ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unl |
| CVE-2026-113652 | 5.6 MEDIUM | ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attac |
| CVE-2026-112958 | 5.4 MEDIUM | ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization |
| CVE-2026-113662 | 5.4 MEDIUM | ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import ma |
| CVE-2026-112951 | 5.4 MEDIUM | ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb |
| CVE-2026-113661 | 5.4 MEDIUM | ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships |
| CVE-2026-113669 | 5.3 MEDIUM | ApostropheCMS: Cross-domain session token in URL confers session takeover |
| CVE-2026-113670 | 5.3 MEDIUM | ApostropheCMS: Page REST API authorization bypass |
| CVE-2026-113667 | 5.3 MEDIUM | ApostropheCMS: CAPTCHA response token not URL-encoded |
| CVE-2026-113668 | 5.3 MEDIUM | ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling |
| CVE-2026-113656 | 5.3 MEDIUM | ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS |
Showing top 20 of 33 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: apostrophe
-
CVE-2026-113711
ApostropheCMS: Unauthenticated resource exhaustion via pre-a -
CVE-2026-113710
ApostropheCMS: No Attempt Throttling on Authenticated Passwo -
CVE-2026-113671
ApostropheCMS: Host header controls server-side image fetch -
CVE-2026-113670
ApostropheCMS: Page REST API authorization bypass -
CVE-2026-113669
ApostropheCMS: Cross-domain session token in URL confers ses
Same vendor: apostrophecms
-
CVE-2026-113711
ApostropheCMS: Unauthenticated resource exhaustion via pre-a -
CVE-2026-113710
ApostropheCMS: No Attempt Throttling on Authenticated Passwo -
CVE-2026-113671
ApostropheCMS: Host header controls server-side image fetch -
CVE-2026-113670
ApostropheCMS: Page REST API authorization bypass -
CVE-2026-113669
ApostropheCMS: Cross-domain session token in URL confers ses
Same weakness: CWE-862
-
CVE-2026-113649
ApostropheCMS: Import API bypasses publication roles for pro -
CVE-2026-112957
ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses -
CVE-2026-113677
Froxlor 0.10.0 before 2.3.15 Missing Authorization via SubDo -
CVE-2026-113612
SparkyFitness before 0.17.0 Missing Authorization via food-v -
CVE-2026-113601
Memos before 0.27.0 Missing Authorization via ActivityServic
V. Comments for CVE-2026-113660
No comments yet