ApostropheCMS: Private and Admin Content Existence Disclosed via doc/slugTaken Endpoint
Summary
The slugTaken endpoint returns a boolean indicating whether a slug is in use across all document types and visibility levels, with no permission or type filter. Any logged-in user (including editors) can enumerate the slug space of private pages, drafts, and archived content.
Details
POST /api/v1/@apostrophecms/doc/slugTaken with body { "slug": "target-slug" } runs a raw existence check against the documents collection. It does not:
- Check whether the requesting user has read permission for documents of that type.
- Filter by
visibility(public, loginRequired, private). - Filter by
viewRole. - Filter by publication status (draft vs published).
A single authenticated session can iterate the slug space to enumerate the full content inventory of the CMS, including content the user is explicitly prohibited from viewing.
PoC
# Any authenticated session works — editor role sufficient
curl -b "$EDITOR_JAR" -X POST \
-H "Content-Type: application/json" \
-d '{"slug":"known-private-page-slug"}' \
"http://TARGET/api/v1/@apostrophecms/doc/slugTaken"
# → { "taken": true } — confirms private page exists
curl -b "$EDITOR_JAR" -X POST \
-H "Content-Type: application/json" \
-d '{"slug":"zzz-nonexistent"}' \
"http://TARGET/api/v1/@apostrophecms/doc/slugTaken"
# → { "taken": false }Impact
Information disclosure. An attacker with any authenticated session can enumerate all slugs in the system, mapping the full content structure of the CMS including private and admin-only content.
What to do
Upgrade ApostropheCMS to version 4.34.0 or later.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | apostrophe | < 4.34.0 | 4.34.0 |
References
- https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-f66c-mpj2-3r8h
- https://nvd.nist.gov/vuln/detail/CVE-2026-112952
- https://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498
- https://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea
- https://github.com/apostrophecms/apostrophe
- https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.34.0
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N- Weakness (CWE)
CWE-200- Platform
- npm
- Package
apostrophe- Disclosed
- 21.10.2026
- Updated
- 21.10.2026 20:23
Sources and licenses · Edited or translated by DockRay; source rights and applicable licenses are retained.
OSV / GitHub Advisory Database - GHSA-f66c-mpj2-3r8h - CC BY 4.0
Vulnerability history: apostrophe
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 33
- First → latest
- 09.2020 10.2026
- Without a fix
- 4
- Exploited in attacks
- 0
Severity breakdown
- Critical 2
- High 9
- Medium 18
- Low 4
Disclosures per year
- 2020: 2
- 2021: 2
- 2022: 0
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 29
-
ApostropheCMS: Private and Admin Content Existence Disclosed via doc/slugTaken Endpoint this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.