CVE-2026-112952: ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user
ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, 'POST /api/v1/@apostrophecms/doc/slugTaken' with body { "slug": "target-slug" } returns a boolean indicating whether a slug is in use across all document types and visibility levels, with no permission or type filter. Any logged-in user (including editors) can enumerate the slug space of private pages, drafts, and archived content. This issue is fixed in version 4.34.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ApostropheCMSto a version that resolves this vulnerability.Fixed in 4.34.0
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user can query the endpoint, including users with editor-level access. No interaction from another user is required.
What information can an attacker learn?
An attacker can submit candidate slugs and learn whether each is in use. The result can reveal the existence of private pages, drafts, archived content, and admin-only content across document types and visibility levels.
Which versions should be remediated?
ApostropheCMS versions prior to 4.34.0 are affected. Upgrade to version 4.34.0, which fixes the permission and type-filtering issue in the slug lookup endpoint.