CVE-2026-112952: ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user
The slugTaken endpoint returns a boolean indicating whether a slug is in use across
all document types and visibility levels, with no permission or type filter. Any logged-in
user (including editors) can enumerate the slug space of private pages, drafts, and
archived content.
References
- github.com/advisories/GHSA-f66c-mpj2-3r8h
- github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498
- github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea
- github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.34.0
- github.com/apostrophecms/apostrophe/security/advisories/GHSA-f66c-mpj2-3r8h
- nvd.nist.gov/vuln/detail/CVE-2026-112952
Code Behaviors & Features
Detect and mitigate CVE-2026-112952 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →