CVE-2026-101004: notionnext-org NotionNext Authentication Guard cache.js cleanCache missing authentication
A security vulnerability has been detected in notionnext-org NotionNext up to 4.10.10. Affected by this issue is the function cleanCache of the file pages/api/cache.js of the component Authentication Guard. The manipulation of the argument token leads to missing authentication. The attack may be initiated remotely. Versions 4.1.0 - 4.9.5.2 allow unauthenticated exploitation due to missing method check. In versions 4.9.5.7 - 4.10.10 a guard present but only enforced when CACHEREVALIDATIONTOKEN is set. Default deployments remain unprotected. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Set CACHE_REVALIDATION_TOKEN so the Authentication Guard protects the cleanCache function.
NotionNext Authentication Guard CACHE_REVALIDATION_TOKEN = set
Event History
Frequently Asked Questions
Which deployments are exposed by default?
Default deployments of NotionNext versions 4.9.5.7 through 4.10.10 remain unprotected because the cache-cleaning guard is enforced only when CACHE_REVALIDATION_TOKEN is configured. Versions 4.1.0 through 4.9.5.2 also permit unauthenticated exploitation because the required method check is missing.
What does an attacker need to exploit this issue?
The attack can be initiated remotely without authentication. Exploitation involves manipulating the token argument passed to the cleanCache function in pages/api/cache.js.
What configuration can reduce exposure if updating is not immediately possible?
For versions 4.9.5.7 through 4.10.10, configure CACHE_REVALIDATION_TOKEN so that the existing guard is enforced. The provided information does not identify an equivalent mitigation for versions 4.1.0 through 4.9.5.2, where the method check is missing.