Notionnext
Monthly
Unauthenticated remote attackers can call the cleanCache handler in NotionNext's pages/api/cache.js to force cache invalidation, degrading availability for sites built on the framework. Every release from 4.1.0 through 4.10.10 is affected: versions 4.1.0-4.9.5.2 perform no HTTP method or authentication check on the endpoint at all, while 4.9.5.7-4.10.10 add a guard that is only enforced when the CACHE_REVALIDATION_TOKEN environment variable is explicitly set, so default deployments remain exposed. Impact is confined to availability (assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) with no data read or write and no code execution; no public exploit code or active exploitation has been identified at time of analysis, and the vendor was contacted but did not respond, so no fix has been confirmed.
Unauthenticated remote attackers can call the cleanCache handler in NotionNext's pages/api/cache.js to force cache invalidation, degrading availability for sites built on the framework. Every release from 4.1.0 through 4.10.10 is affected: versions 4.1.0-4.9.5.2 perform no HTTP method or authentication check on the endpoint at all, while 4.9.5.7-4.10.10 add a guard that is only enforced when the CACHE_REVALIDATION_TOKEN environment variable is explicitly set, so default deployments remain exposed. Impact is confined to availability (assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) with no data read or write and no code execution; no public exploit code or active exploitation has been identified at time of analysis, and the vendor was contacted but did not respond, so no fix has been confirmed.