{"id":"EUVD-2026-105102","enisaUuid":"f6974fe5-110d-3899-800b-85a1d47c022c","description":"ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, \u0027POST /api/v1/@apostrophecms/doc/slugTaken\u0027 with body { \"slug\": \"target-slug\" } returns a boolean indicating whether a slug is in use across all document types and visibility levels, with no permission or type filter. Any logged-in user (including editors) can enumerate the slug space of private pages, drafts, and archived content. This issue is fixed in version 4.34.0.","datePublished":"Oct 20, 2026, 3:44:33 PM","dateUpdated":"Oct 21, 2026, 3:53:58 PM","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-f66c-mpj2-3r8h\nhttps://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498\nhttps://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea\nhttps://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.34.0\n","aliases":"CVE-2026-112952\nGHSA-f66c-mpj2-3r8h\n","assigner":"GitHub_M","epss":0.33,"enisaIdProduct":[{"id":"3af07dd7-f461-3157-bbac-e77737a7a1b9","product":{"name":"Apostrophe ","vendor":{"name":"apostrophecms"}},"product_version":"\u003c 4.34.0"}],"enisaIdVendor":[{"id":"a5e37c24-dec2-37a1-9849-7883304af133","vendor":{"name":"apostrophecms"}}],"enisaIdVulnerability":[{"id":"a5863879-33f6-3499-9114-793500f5a219","vulnerability":{"id":"CVE-2026-112952","description":"ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, \u0027POST /api/v1/@apostrophecms/doc/slugTaken\u0027 with body { \"slug\": \"target-slug\" } returns a boolean indicating whether a slug is in use across all document types and visibility levels, with no permission or type filter. Any logged-in user (including editors) can enumerate the slug space of private pages, drafts, and archived content. This issue is fixed in version 4.34.0.","datePublished":"Oct 20, 2026, 3:44:33 PM","dateUpdated":"Oct 21, 2026, 3:53:58 PM","status":"PUBLISHED","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-f66c-mpj2-3r8h\nhttps://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498\nhttps://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea\nhttps://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.34.0\n","enisa_id":"EUVD-2026-105102\n","assigner":"GitHub_M","epss":0.33,"dataProcessed":"Nov 1, 2026, 4:02:33 AM","vulnerabilityProduct":[{"id":"d8a25dc2-db81-3c3f-8652-f67638c37a06","product":{"name":"Apostrophe ","vendor":{"name":"apostrophecms"}},"product_version":"\u003c 4.34.0"}],"vulnerabilityVendor":[{"id":"972a393f-d90f-3a25-9019-f6b4bc166f82","vendor":{"name":"apostrophecms"}}]}},{"id":"c185e7cf-5f4e-3ab8-b8c4-2c3b8bdca017","vulnerability":{"id":"GHSA-f66c-mpj2-3r8h","description":"ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user","datePublished":"Oct 21, 2026, 5:17:00 PM","dateUpdated":"Oct 21, 2026, 5:17:00 PM","baseScore":0.0,"references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-f66c-mpj2-3r8h\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-112952\nhttps://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498\nhttps://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea\nhttps://github.com/apostrophecms/apostrophe\nhttps://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.34.0\n","enisa_id":"EUVD-2026-105102\n","aliases":"CVE-2026-112952\nGHSA-f66c-mpj2-3r8h\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:08:27 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}