The vulnerability exists in the cleanCache function of pages/api/cache.js, where manipulating the token input bypasses authentication checks. This allows an attacker to gain unauthorized access to protected resources, potentially compromising confidentiality, integrity, and availability of the application. The weakness is reflected in CWE‑287 and CWE‑306, categories for authentication and authorization failures.

NotionNext versions up to 4.10.10 are affected. In versions 4.1.0 through 4.9.5.2, the flaw permits unauthenticated exploitation because a required method check is missing. In later releases 4.9.5.7 through 4.10.10 a guard is present but is only enforced when the environment variable CACHE_REVALIDATION_TOKEN is defined; default deployments typically leave this variable unset, leaving the system unprotected.

The CVSS score of 6.9 indicates a moderate severity, and no EPSS score is currently available. The vulnerability is not listed in CISA's KEV catalog. Attackers can initiate exploitation from remote locations by crafting requests that alter the token argument, and the lack of protection in default deployments makes success likely for unauthenticated users.