Security Flaw in ApostropheCMS Allows Slug Enumeration

CVE-2026-112952

What is CVE-2026-112952?

ApostropheCMS, an open-source Node.js content management system, has a vulnerability in the API endpoint POST /api/v1/@apostrophecms/doc/slugTaken. Before version 4.34.0, this endpoint exposes a boolean response that indicates whether a specific slug is being used across all document types, including private pages and drafts, without necessary permission controls. This allows any logged-in user, including editors, to enumerate slugs of restricted content, leading to potential information exposure. The issue has been addressed in version 4.34.0, which implements proper permissions and type filtering.

References