ApostropheCMS EUVD-2026-105208

Requires a valid authenticated low-privilege account on the target ApostropheCMS instance (PR:L) and the ability to call the exist-in-locale API endpoint; exploitation then works against default configurations with no special feature toggle. What limits it: an attacker must already hold working credentials (no unauthenticated access), the impact is confined to confirming existence and retrieving localized identifiers of restricted/draft documents (confidentiality only, no modification or full-content disclosure), and only ApostropheCMS versions prior to 4.33.0 are affected.

This is a genuine but low-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3 Medium) is internally consistent with the description: network-reachable, low attack complexity, but requiring an authenticated low-privilege account (PR:L) and yielding only limited confidentiality impact (C:L) with no integrity or availability effect. The underlying weakness is CWE-862 (Missing Authorization) - the exist-in-locale API discloses whether restricted documents exist in a given locale and mode (including draft) and returns localized document identifiers without enforcing per-document view/edit checks. This is an information-disclosure/enumeration flaw, not code execution or takeover. No EPSS score, CISA KEV listing, POC, or SSVC data was provided in the input, so exploitation probability and automatability cannot be quantified. Given the authentication requirement, confidentiality-only impact, and absence of any exploitation signal, this is a real-but-low-risk issue rather than an urgent priority - patch in normal maintenance cycles. Caveat: the input 'Authentication Bypass' tag is misleading; exploitation requires a valid authenticated session, so this is an authorization (authz) gap, not an authentication bypass.

A low-privilege authenticated user of an ApostropheCMS site (e.g. a limited editor or registered contributor) sends requests to the exist-in-locale API to probe whether specific restricted documents exist across locales and modes, including unpublished draft mode. The endpoint returns localized document identifiers without checking the caller's view/edit permissions, letting the user confirm the existence of content they should not be able to see. No public exploit identified at time of analysis.