ApostropheCMS’s endpoint 'POST /api/v1/@apostrophecms/doc/slugTaken' returns a simple boolean indicating whether a slug exists without filtering on visibility or content type. Because this endpoint is accessible to any authenticated user, an attacker can enumerate slugs for private or draft pages, revealing the existence of confidential or admin‑only content. The primary impact is the disclosure of information that can aid further attacks such as content reconnaissance or phishing. The vulnerability is described by CWE-200, an informational disclosure weakness.

The flaw applies to all releases of ApostropheCMS built on Node.js that predate version 4.34.0, including the main 'apostrophecms:apostrophe' product. If a site is running any older major or minor release where the endpoint lacks the permission check, it is vulnerable.

The CVSS score of 4.3 indicates moderate risk. EPSS data is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. The attack vector requires authenticated access, so the threat is limited to users who have legitimate login credentials. However, the ease of enumerating slugs could be leveraged by attackers to discover hidden routes or craft targeted credential‑stuffing campaigns.