ChangeIntel IT change radar

Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-101004

notionnext-org NotionNext Authentication Guard cache.js cleanCache missing authentication

CVSS 4.0 6.9 MEDIUMCVSS 3.1 5.3 MEDIUMCVSS 3.0 5.3 MEDIUMCVSS 2.0 5.0 Check source for fixed versionsKEV status unknown

Original advisory

Historical advisory recorded 23 Oct 2026 15:48:27 UTC. Read the latest advisory.

cve-program · CVE-2026-101004

Published

A security vulnerability has been detected in notionnext-org NotionNext up to 4.10.10. Affected by this issue is the function cleanCache of the file pages/api/cache.js of the component Authentication Guard. The manipulation of the argument token leads to missing authentication. The attack may be initiated remotely. Versions 4.1.0 - 4.9.5.2 allow unauthenticated exploitation due to missing method check. In versions 4.9.5.7 - 4.10.10 a guard present but only enforced when CACHE_REVALIDATION_TOKEN is set. Default deployments remain unprotected. The vendor was contacted early about this disclosure but did not respond in any way.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-101004

Published

NotionNext

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "notionnext-org",
                    "product": "NotionNext",
                    "versions": [
                        {
                            "version": "4.10.0",
                            "status": "affected"
                        },
                        {
                            "version": "4.10.1",
                            "status": "affected"
                        },
                        {
                            "version": "4.10.2",
                            "status": "affected"
                        },
                        {
                            "version": "4.10.3",
                            "status": "affected"
                        },
                        {
                            "version": "4.10.4",
                            "status": "affected"
                        },
                        {
                            "version": "4.10.5",
                            "status": "affected"
                        },
                        {
                            "version": "4.10.6",
                            "status": "affected"
                        },
                        {
                            "version": "4.10.7",
                            "status": "affected"
                        },
                        {
                            "version": "4.10.8",
                            "status": "affected"
                        },
                        {
                            "version": "4.10.9",
                            "status": "affected"
                        },
                        {
                            "version": "4.10.10",
                            "status": "affected"
                        }
                    ],
                    "cpes": [
                        "cpe:2.3:a:notionnext-org:notionnext:*:*:*:*:*:*:*:*"
                    ],
                    "modules": [
                        "Authentication Guard"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON