GHSA-gqh3-7856-rjjg

Source

https://github.com/advisories/GHSA-gqh3-7856-rjjg

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-gqh3-7856-rjjg/GHSA-gqh3-7856-rjjg.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-gqh3-7856-rjjg

Aliases

CVE-2026-113668

Published

2026-10-20T18:14:32Z

Modified

2026-10-20T18:30:03Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)

Details

Summary

The REST route GET /api/v1/<piece-type>/:_id/locales (and the equivalent page route) does not apply the publicApiCheckAsync gate that ApostropheCMS's other read routes enforce. An unauthenticated caller can therefore query this route for any document _id and learn whether the document exists and which locales it is published in — a document-existence and locale-metadata disclosure that the read-API is otherwise supposed to gate.

Affected

Repository: apostrophecms/apostrophe (monorepo package apostrophe).
Confirmed at 4.32.2 (commit d3ff8c9 == the shipped 4.32.2; unchanged at current HEAD). No fix at time of report.
Stack: Node.js / Express + MongoDB.
Endpoints: GET /api/v1/<piece-type>/:_id/locales and GET /api/v1/@apostrophecms/page/:_id/locales.

Technical detail

Unsafe: modules/@apostrophecms/piece-type/index.js:397 registers the :_id/locales route with no publicApiCheckAsync. The page module has the same omission at modules/@apostrophecms/page/index.js:925.
Gated siblings: the read routes in the same module (e.g. getAll at piece-type/index.js:256-263) call publicApiCheckAsync (:263) to enforce the public-API access policy.
So the locales handler (which calls getLocales() for the document) runs for any caller regardless of the public-API gate the other read routes apply, returning the document's locale/publication metadata without authorization.

Impact

An unauthenticated caller can confirm the existence of a document by _id and enumerate its locales/publication state — information the read-API is meant to gate. Defensibly 4.3 (AC:H) given the opaque _id precondition (the caller needs a document id).

How it was verified (local only)

Reproduced against apostrophe@4.32.2 (== commit d3ff8c9) locally with synthetic content:

Source review confirmed the :_id/locales route lacks publicApiCheckAsync while the sibling read routes have it.
An unauthenticated GET /api/v1/<piece-type>/<_id>/locales returned the document's locale metadata (existence + locales), while the gated read routes (e.g. getAll) correctly required the public-API policy.
Control: the same route with the publicApiCheckAsync gate added (matching the siblings) denies the unauthenticated request — isolating the missing gate as the cause. Synthetic content only; nothing hosted was touched.

Remediation

Add the publicApiCheckAsync (or equivalent) authorization gate to the :_id/locales route in both the piece-type and page modules, matching the sibling read routes, so the locale/existence metadata is only returned to callers permitted by the public-API policy.

Credit

Please credit Santosh Kumar Puppala (https://github.com/Santoshkumarpuppala).

Database specific

{
    "cwe_ids":  [
        "CWE-200",
        "CWE-862"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-10-20T18:14:32Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}

References

Affected packages

npm / apostrophe

Package

Name: apostrophe; View open source insights on deps.dev
Purl: pkg:npm/apostrophe

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

4.33.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-gqh3-7856-rjjg/GHSA-gqh3-7856-rjjg.json"