CVE-2026-112952
Received Received - Intake

ApostropheCMS Slug Enumeration Vulnerability

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: GitHub, Inc.

Description
ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, 'POST /api/v1/@apostrophecms/doc/slugTaken' with body { "slug": "target-slug" } returns a boolean indicating whether a slug is in use across all document types and visibility levels, with no permission or type filter. Any logged-in user (including editors) can enumerate the slug space of private pages, drafts, and archived content. This issue is fixed in version 4.34.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-112952
EUVD
EUVD-2026-105102

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apostrophecms apostrophe < 4.34.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects ApostropheCMS versions before 4.34.0. The /api/v1/@apostrophecms/doc/slugTaken endpoint reveals whether a slug exists across all document types and visibility levels without checking permissions. Any logged-in user can probe slugs to map private pages, drafts, or archived content they should not access.

Detection Guidance

To detect this vulnerability, check if your ApostropheCMS version is below 4.34.0. Test the affected endpoint by sending a POST request to /api/v1/@apostrophecms/doc/slugTaken with a slug value and observe if it returns a boolean indicating slug usage across all document types without permission checks.

Example command using curl: curl -X POST -H 'Content-Type: application/json' -d '{"slug":"test-slug"}' http://your-cms-domain/api/v1/@apostrophecms/doc/slugTaken

Impact Analysis

An attacker with any authenticated session could discover private or restricted content by checking slugs. This enables mapping the entire CMS structure, including admin-only or unpublished pages, leading to potential data exposure or further attacks.

Compliance Impact

This vulnerability could violate GDPR or HIPAA by exposing private user data or sensitive content through unauthorized slug enumeration. Compliance may be impacted if the exposed data includes personally identifiable information or protected health information.

Mitigation Strategies

Immediately upgrade ApostropheCMS to version 4.34.0 or later to patch the vulnerability. If immediate upgrade is not possible, restrict access to the /api/v1/@apostrophecms/doc/slugTaken endpoint via network-level controls or application firewall rules until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112952. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart