npm · apostrophe
ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user
The slugTaken endpoint returns a boolean indicating whether a slug is in use across
all document types and visibility levels, with no permission or type filter. Any logged-in
user (including editors) can enumerate the slug space of private pages, drafts, and
archived content.
POST /api/v1/@apostrophecms/doc/slugTaken with body { "slug": "target-slug" } runs
a raw existence check against the documents collection. It does not:
visibility (public, loginRequired, private).viewRole.A single authenticated session can iterate the slug space to enumerate the full content inventory of the CMS, including content the user is explicitly prohibited from viewing.
# Any authenticated session works — editor role sufficient
curl -b "$EDITOR_JAR" -X POST \
-H "Content-Type: application/json" \
-d '{"slug":"known-private-page-slug"}' \
"http://TARGET/api/v1/@apostrophecms/doc/slugTaken"
# → { "taken": true } — confirms private page exists
curl -b "$EDITOR_JAR" -X POST \
-H "Content-Type: application/json" \
-d '{"slug":"zzz-nonexistent"}' \
"http://TARGET/api/v1/@apostrophecms/doc/slugTaken"
# → { "taken": false }
Information disclosure. An attacker with any authenticated session can enumerate all slugs in the system, mapping the full content structure of the CMS including private and admin-only content.
Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.
Check my repoSources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.