ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user

影響: npm:apostrophe < 4.34.0 → 4.34.0

The slugTaken endpoint returns a boolean indicating whether a slug is in use across all document types and visibility levels, with no permission or type filter. Any logged-in user (including editors) can enumerate the slug space of private pages, drafts, and archived content. Details POST /api/v1/@apostrophecms/doc/slugTaken with body { "slug": "target-slug" } runs a raw existence check against the documents collection. It does not: - Check whether the requesting user has read permissio…

在 GitHub Advisory Database 阅读

2026/10/22 02:17，GitHub Advisory Database 发布了“ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user”（类型：漏洞公告）。严重程度为“中危”（medium）。相关技术：JavaScript / Node.js。CVE：CVE-2026-112952。