GHSA-gqh3-7856-rjjg ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)

• npm apostrophe: < 4.33.0 → fixed in 4.33.0

Summary The REST route `GET /api/v1//:_id/locales` (and the equivalent page route) does not apply the `publicApiCheckAsync` gate that ApostropheCMS's other read routes enforce. An unauthenticated caller can therefore query this route for any document `_id` and learn whether the document exists and which locales it is published in — a document-existence and locale-metadata disclosure that the read-API is otherwise supposed to gate. Affected • Repository: `apostrophecms/apostrophe` (monorepo package `apostrophe`). • Confirmed at 4.32.2 (commit `d3ff8c9` == the shipped 4.32.2; unchanged at current HEAD). No fix at time of report. • Stack: Node.js / Express + MongoDB. • Endpoints: `GET /api/v1//:_id/locales` and `GET /api/v1/@apostrophecms/page/:_id/locales`. Technical detail • Unsafe: `modules/@apostrophecms/piece-type/index.js:397` registers the `:_id/locales` route with no `publicApiCheckAsync`. The page module has the same omission at `modules/@apostrophecms/page/index.js:925`. • Gated siblings: the read routes in the same module (e.g. `getAll` at `piece-type/index.js:256-263`) call `publicApiCheckAsync` (`:263`) to enforce the public-API access policy. • So the `locales` handler (which calls `getLocales()` for the document) runs for any caller regardless of the public-API gate the other read routes apply, returning the document's locale/publication metadata without authorization. Impact An unauthenticated caller can confirm the existence of a document by `_id` and enumerate its locales/publication state — information the read-API is meant to gate. Defensibly 4.3 (AC:H) given the opaque `_id` precondition (the caller needs a document id). How it was verified (local only) Reproduced against `[email protected]` (== commit `d3ff8c9`) locally with synthetic content: • Source review confirmed the `:_id/locales` route lacks `publicApiCheckAsync` while the sibling read routes have it. • An unauthenticated `GET /api/v1///locales` returned the document's locale metadata (existence + locales), while the gated read routes (e.g. `getAll`) correctly required the public-API policy. • Control: the same route with the `publicApiCheckAsync` gate added (matching the siblings) denies the unauthenticated request — isolating the missing gate as the cause. Synthetic content only; nothing hosted was touched. Remediation Add the `publicApiCheckAsync` (or equivalent) authorization gate to the `:_id/locales` route in both the piece-type and page modules, matching the sibling read routes, so the locale/existence metadata is only returned to callers permitted by the public-API policy. Credit Please credit Santosh Kumar Puppala (https://github.com/Santoshkumarpuppala).