CVE-2026-112952: ApostropheCMS Information Disclosure via Slug Enumeration
Summary
CVE-2026-112952: The slugTaken endpoint returns a boolean indicating whether a slug is in use across all document types and visibility levels, with no permission or type filter. Affects apostrophe versions < 4.34.0. Fixed in 4.34.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ApostropheCMS is an open-source content management system (CMS) designed for building websites and applications with a focus on ease of use and flexibility. It allows users to create, manage, and publish content seamlessly. However, a vulnerability exists in the slugTaken API endpoint, which can expose private and admin-only content to authenticated users, undermining the security of the CMS.
Vulnerability Detail
The vulnerability arises from the slugTaken endpoint in ApostropheCMS, which allows any authenticated user to check if a slug is in use without proper permission checks. This endpoint returns a boolean indicating the existence of a slug across all document types and visibility levels, including private pages, drafts, and archived content. As a result, an attacker can enumerate slugs and gain insights into the full content inventory of the CMS, including sensitive information they should not have access to.
How To Fix
Latest published version: 4.34.0 as of 23 Oct 2026
npm install apostrophe@4.34.0The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the slugTaken endpoint by implementing custom middleware that checks user permissions before allowing access to this API. However, this is not a permanent solution and updating the package is recommended.
Conclusion
The ApostropheCMS vulnerability CVE-2026-112952 poses a significant risk by allowing authenticated users to enumerate private content through the slugTaken endpoint. It is crucial to update to the patched version 4.34.0 or later to mitigate this risk and protect sensitive information.
See every vulnerability recorded for apostrophe →
FAQ
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
Any authenticated user with access to the ApostropheCMS can exploit this vulnerability, including editors and contributors.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you cannot update the package right away, implement custom middleware to restrict access to the slugTaken endpoint as a temporary measure.
The impact includes information disclosure, allowing attackers to enumerate slugs and potentially access sensitive content that should be restricted.
References
Related vulnerabilities
Recent vulnerabilities recorded for apostrophe.
