The vulnerability resides in the exist-in-locale API of ApostropheCMS, allowing an authenticated low‑privilege user to query whether a restricted document exists in a specific locale and mode, including draft mode, and receive the localized document identifiers without applying a document‑level view or edit authorization check. This enables the attacker to discover the identifiers of documents the user is not authorized to view, leading to the disclosure of internal document structure and potential access to sensitive content.

ApostropheCMS versions prior to 4.33.0 are vulnerable. The fix was introduced in the 4.33.0 release. The affected product is ApostropheCMS (vendor apostrophecms). Site administrators should verify the specific version of ApostropheCMS in use and ensure it is updated to at least 4.33.0.

The CVSS score of 4.3 indicates low overall severity, and there is no EPSS score available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires an authenticated low‑privilege account, which is a common condition in many deployments. The primary risk is information disclosure rather than privilege escalation or remote code execution. The vulnerability is likely exploitable by having the attacker send a request to the exist-in-locale endpoint and read the returned identifiers, as inferred from the description.