ApostropheCMS CVE-2026-112952

Requires an authenticated session as any logged-in user, explicitly including low-privileged editors (PR:L) - it is NOT remotely exploitable by anonymous users. The attacker sends POST /api/v1/@apostrophecms/doc/slugTaken with a JSON body {"slug":"target-slug"}; the endpoint applies no permission, document-type, or visibility filter, so the boolean response reveals slug existence across private pages, drafts, and archived content on any default ApostropheCMS install prior to 4.34.0. No special configuration or user interaction is needed; the only limiting factor is that the attacker must already hold valid login credentials, and the leaked data is confined to slug existence rather than document contents.

This is a genuine but low-severity information-disclosure issue, and the signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) matches the description precisely: network-reachable API, trivial complexity, but requires a valid low-privileged login (PR:L), and only leaks a boolean (C:L; no integrity or availability impact). There is no EPSS score, no CISA KEV listing, and no public exploit code referenced - so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was provided. In SSVC terms the technical impact is partial at most and the flaw is automatable (a scripted dictionary against the endpoint), but the information gained is limited to slug existence, not content. This should be treated as a routine patch-management item rather than an urgent priority: the ceiling is enumeration of private/draft/archived slug names by an already-authenticated insider, which is a confidentiality/recon concern, not a path to compromise. No key data is missing in a way that changes the conclusion; the absence of EPSS/KEV/POC is expected for a minor info-leak and is not itself a risk signal.

A logged-in editor (or any authenticated user) who should not see unpublished content scripts repeated POST requests to /api/v1/@apostrophecms/doc/slugTaken with candidate slug values, reading the returned boolean to confirm which slugs exist. By iterating over a wordlist or predictable naming scheme, they map out private pages, drafts, and archived documents they were never authorized to know about. No public exploit code is referenced, but the attack is trivial to reproduce from the advisory description.