ApostropheCMS EUVD-2026-105216

Exploitable against default ApostropheCMS deployments prior to 4.33.0 because the GET /api/v1/<piece-type>/:_id/locales route (and the equivalent page route) omits the publicApiCheckAsync gate that other read routes enforce - no special feature toggle or non-default configuration is needed. Exploitation is unauthenticated (PR:N) and requires no user interaction (UI:N). The practical limit is impact scope, not access: the attacker must supply or guess a document _id and only learns that document's existence and published locales, not its contents; integrity and availability are unaffected. Sites fronted by authentication/WAF controls on the REST API, or already upgraded to 4.33.0, are not exposed.

The signals are consistent with a genuine but low-severity information-disclosure issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3 Medium) indicates a network-reachable, low-complexity, unauthenticated flaw with only limited confidentiality impact and no integrity or availability effect - matching the description precisely (CWE-200, document-existence and locale-metadata disclosure). No EPSS score, SSVC decision, KEV listing, or public POC was supplied in the input; per the precision rules this means no public exploit is identified at time of analysis and exploitation is not confirmed in the wild. There is no conflict between the CVSS vector and the description: both agree on unauthenticated network access with confined read-only impact. The missing automatable/technical-impact SSVC data and absent EPSS probability should be noted - real-world exploitation likelihood cannot be quantified from the provided data - but the intrinsic ceiling is low because the attacker only learns whether a given document _id exists and which locales it is published in, not the document contents. Priority is therefore low-to-moderate: patch in routine maintenance rather than emergency, unless an environment treats document-ID/locale enumeration as sensitive reconnaissance.

An unauthenticated attacker scripts requests to GET /api/v1/<piece-type>/:_id/locales (or the equivalent page route) against a target ApostropheCMS site, iterating candidate document _id values. The route skips the publicApiCheckAsync gate, so each response reveals whether that document exists and which locales it is published in, letting the attacker map hidden or draft content and localization structure. No public exploit code is identified at time of analysis; the attack requires only standard HTTP requests given the AV:N/AC:L/PR:N/UI:N vector.