CVE-2026-113660

**Summary** ApostropheCMS’s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mode, including draft mode. The endpoint returns localized document identifiers without applying document-level view or edit authorization criteria. The issue was reproduced against a real local ApostropheCMS application running the reviewed source code. The test used a synthetic guest account and synthetic restricted draft records. **Details** Exact vulnerable source path: ` packages/apostrophe/modules/@apostrophecms/i18n/index.js:503-529` Exact API route:` POST /api/v1/@apostrophecms/i18n/exist-in-locale` The handler verifies only that the requester is authenticated: ``` if (!req.user) { throw self.apos.error('notfound'); } ``` It then performs a direct database lookup using attacker-controlled document IDs, locale, and mode: ``` const found = await self.apos.doc.db.find({ aposLocale: `${locale}:${mode}`, aposDocId: { $in: ids.map(self.apos.doc.toAposDocId) } }).project({ _id: 1, aposDocId: 1 }).toArray(); ``` This query does not apply: .permission('view') .permission('edit') apos.permission.criteria(req, 'view') object-level document authorization locale-specific authorization The endpoint accepts multiple IDs, making bulk probing possible. **Proof of Concept** The local application was running at: http://127.0.0.1:3000 The test account had the low-privilege role: guest The local database contained synthetic records for the restricted document base ID: ``` wv2l4rbaplgzkg80zkne4aoz:en:draft wv2l4rbaplgzkg80zkne4aoz:fr:draft ``` All credentials and cookies are intentionally redacted below. ``` POST /api/v1/@apostrophecms/i18n/exist-in-locale HTTP/1.1 Host: 127.0.0.1:3000 Cookie: <redacted-authenticated-guest-session> Content-Type: application/json Accept: application/json { "ids": [ "wv2l4rbaplgzkg80zkne4aoz:en:draft", "ckzzzzzzzzzzzzzzzzzzzzzzz:en:draft" ], "loca