Pre-Auth Navigation Tree Disclosure: Unrestricted /api/nodes Endpoint Fix

Key Vulnerability Information Summary Vulnerability Overview Type: Navigation Tree Disclosure Root Cause: The endpoint lacks permission controls for anonymous visitors, allowing them to view the navigation tree (page names, URLs, etc.) of the current site's published languages, thereby leaking the site structure. Remediation Goal: Restrict to authenticated users only. Anonymous visitors should only see the published pages under the current site's published languages, preventing the leakage of restricted/unpublished/external nodes. Scope of Impact Affected Endpoint: ( ) Affected Objects: - Anonymous visitors can see the navigation tree (page names, URLs) of the current site's published languages - Content that should be restricted, such as restricted pages, unpublished pages, external nodes, and nodes from other sites Impact: Leakage of site structure, page naming, and URL information, which may aid attackers in further reconnaissance. Remediation Plan 1. Access Control: Add authentication checks to the action in to allow only authenticated users to access it. 2. Data Filtering: - Return only published pages under the current site's published languages - Exclude restricted pages, unpublished pages, external nodes, and nodes from other sites 3. Test Coverage: Add test cases in and to verify that: - Anonymous visitors can only see published pages - Authenticated users (guest/member/admin) have access scopes differentiated by role - Restricted/unpublished/external/nodes from other sites are correctly filtered based on permissions POC / Exploitation Code The screenshot does not include a standalone POC or exploitation code block; the relevant verification logic is reflected in the test files (e.g., , ). Example core assertions:

Goal Reached Thanks to every supporter — we hit 100%!

Pre-Auth Navigation Tree Disclosure: Unrestricted /api/nodes Endpoint Fix

More from this source