An open‑source CMS had a REST route that omitted the public‑API authorization check, allowing unauthenticated callers to query any document ID and learn whether the document exists and which locales it is published in. This exposes document existence information and locale metadata that should be gated, constituting an information disclosure vulnerability. The weakness arises from missing access control enforcement on the GET /api/v1/<piece‑type>/:_id/locales endpoint.

Any deployment of ApostropheCMS earlier than version 4.33.0 is vulnerable. The affected product is ApostropheCMS from the Apostrophe team. Systems that provide the /api/v1 or /api/v2 endpoints and rely on the public API without proper authentication are at risk. Upgrading to 4.33.0 or later removes the flaw.

The CVSS base score is 5.3, indicating moderate severity. EPSS is not available, so the current exploitation probability is unknown. The vulnerability is not listed in CISA KEV, implying no known public exploitation. The attack vector is web‑based: an attacker can send an unauthenticated HTTP GET request to the documented route and observe the response to discover existence and locale data. Because the flaw is purely an information disclosure, an attacker does not need privileged access; the path is straightforward for anyone with network access to the API endpoint.