{"id":"ghsa-ghsa-f66c-mpj2-3r8h","seq":32728,"kind":"advisory","title":"ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user","url":"https://github.com/advisories/GHSA-f66c-mpj2-3r8h","permalink":"https://vulnpulse.app/items/ghsa-ghsa-f66c-mpj2-3r8h","summary":"影響: npm:apostrophe < 4.34.0 → 4.34.0\nSummary The slugTaken endpoint returns a boolean indicating whether a slug is in use across all document types and visibility levels, with no permission or type filter. Any logged-in user (including editors) can enumerate the slug space of private pages, drafts, and archived content. Details POST /api/v1/@apostrophecms/doc/slugTaken with body { \"slug\": \"target-slug\" } runs a raw existence check against the documents collection. It does not: - Check whether the requesting user has read permissio…","severity":"medium","techs":["nodejs"],"cves":["CVE-2026-112952"],"tags":["GHSA-f66c-mpj2-3r8h","apostrophe"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-21T17:17:00.000Z","fetched_at":"2026-10-21T18:28:52.985Z"}