Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.
Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.
While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.
Severity: info
Fingerprint: 5733ddf49ff49cd1f3d88d60a85a4166bf4d1fb40a9e09c69a0eb76321b20f1e
Public Swagger UI/API detected at path: /swagger/v1/swagger.json - sample paths:
GET /api/v1/general/languages
GET /api/v1/general/settings
GET /api/v1/general/sitemap
GET /api/v1/general/translations
GET /api/v1/health
GET /api/v1/jobs/list
GET /api/v1/jobs/{id}
GET /api/v1/newsletter/permissions
GET /api/v1/pages
GET /api/v1/pages/article-explore-panels
GET /api/v1/pages/root
GET /api/v1/pages/{id}
GET /api/v1/pages/{id}/ancestors
GET /api/v1/pages/{id}/children
GET /api/v1/pages/{id}/descendants
GET /api/v1/search
GET /umbraco/api/contentupdatercontroller/changedoctype
GET /umbraco/api/contentupdatercontroller/clean
GET /umbraco/api/contentupdatercontroller/clone
GET /umbraco/api/contentupdatercontroller/doctype
GET /umbraco/api/contentupdatercontroller/update
POST /api/v1/accounts/sign-up
POST /api/v1/newsletter/sign-up
POST /api/v1/recaptcha/verify-token