https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 29 Oct 2026 20:54:36 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-112952 <p>ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, &#39;POST /api/v1/@apostrophecms/doc/slugTaken&#39; with body { &#34;slug&#34;: &#34;target-slug&#34; } returns a boolean indicating whether a slug is in use across all document types and visibility levels, with no permission or type filter. Any logged-in user (including editors) can enumerate the slug space of private pages, drafts, and archived content. This issue is fixed in version 4.34.0.</p> <p>ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, &#39;POST /api/v1/@apostrophecms/doc/slugTaken&#39; with body { &#34;slug&#34;: &#34;target-slug&#34; } returns a boolean indicating whether a slug is in use across all document types and visibility levels, with no permission or type filter. Any logged-in user (including editors) can enumerate the slug space of private pages, drafts, and archived content. This issue is fixed in version 4.34.0.</p> https://db.gcve.eu/vuln/fkie_cve-2026-112952 https://db.gcve.eu/vuln/ghsa-f66c-mpj2-3r8h <p><strong>Affected:</strong> npm: apostrophe</p> <p>### Summary The `slugTaken` endpoint returns a boolean indicating whether a slug is in use across all document types and visibility levels, with no permission or type filter. Any logged-in user (including editors) can enumerate the slug space of private pages, drafts, and archived content.</p> <p>### Details `POST /api/v1/@apostrophecms/doc/slugTaken` with body `{ &#34;slug&#34;: &#34;target-slug&#34; }` runs a raw existence check against the documents collection. It does not: - Check whether the requesting user has read permission for documents of that type. - Filter by `visibility` (public, loginRequired, private). - Filter by `viewRole`. - Filter by publication status (draft vs published).</p> <p>A single authenticated session can iterate the slug space to enumerate the full content inventory of the CMS, including content the user is explicitly prohibited from viewing.</p> <p>### PoC ```bash # Any authenticated session works — editor role sufficient curl -b &#34;$EDITOR_JAR&#34; -X POST \ -H &#34;Content-Type: application/json&#34; \ -d &#39;{&#34;slug&#34;:&#34;known-private-page-slug&#34;}&#39; \ &#34;http://TARGET/api/v1/@apostrophecms/doc/slugTaken&#34; # → { &#34;taken&#34;: true } — confirms private page exists</p> <p>curl -b &#34;$EDITOR_JAR&#34; -X POST \ -H &#34;Content-Type: application/json&#34; \ -d &#39;{&#34;slug&#34;:&#34;zzz-nonexistent&#34;}&#39; \ &#34;http://TARGET/api/v1/@apostrophecms/doc/slugTaken&#34; # → { &#34;taken&#34;: false } ```</p> <p>### Impact Information disclosure. An attacker with any authenticated session can enumerate all slugs in the system, mapping the full content structure…</p> <p><strong>Affected:</strong> npm: apostrophe</p> <p>### Summary The `slugTaken` endpoint returns a boolean indicating whether a slug is in use across all document types and visibility levels, with no permission or type filter. Any logged-in user (including editors) can enumerate the slug space of private pages, drafts, and archived content.</p> <p>### Details `POST /api/v1/@apostrophecms/doc/slugTaken` with body `{ &#34;slug&#34;: &#34;target-slug&#34; }` runs a raw existence check against the documents collection. It does not: - Check whether the requesting user has read permission for documents of that type. - Filter by `visibility` (public, loginRequired, private). - Filter by `viewRole`. - Filter by publication status (draft vs published).</p> <p>A single authenticated session can iterate the slug space to enumerate the full content inventory of the CMS, including content the user is explicitly prohibited from viewing.</p> <p>### PoC ```bash # Any authenticated session works — editor role sufficient curl -b &#34;$EDITOR_JAR&#34; -X POST \ -H &#34;Content-Type: application/json&#34; \ -d &#39;{&#34;slug&#34;:&#34;known-private-page-slug&#34;}&#39; \ &#34;http://TARGET/api/v1/@apostrophecms/doc/slugTaken&#34; # → { &#34;taken&#34;: true } — confirms private page exists</p> <p>curl -b &#34;$EDITOR_JAR&#34; -X POST \ -H &#34;Content-Type: application/json&#34; \ -d &#39;{&#34;slug&#34;:&#34;zzz-nonexistent&#34;}&#39; \ &#34;http://TARGET/api/v1/@apostrophecms/doc/slugTaken&#34; # → { &#34;taken&#34;: false } ```</p> <p>### Impact Information disclosure. An attacker with any authenticated session can enumerate all slugs in the system, mapping the full content structure…</p> https://db.gcve.eu/vuln/ghsa-f66c-mpj2-3r8h