CVE-2026-63669
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
ApostropheCMS before 4.32.0 has a vulnerability in the page module's move() operation that fails to enforce the destination parent's _create permission for ordinary moves, allowing an authenticated editor or contributor to move a controlled page into a restricted subtree and re-rank protected sibling pages.
Risk Assessment
The risk includes unauthorized modification of content structure and access control bypass, potentially leading to privilege escalation or unwanted changes.
Recommendation
It is recommended to upgrade to version 4.32.0 or later, which includes the fix.
Original NVD description (English source)
ApostropheCMS is an open-source Node.js content management system. Prior to 4.32.0, the page module's move() operation fails to enforce the destination parent's _create permission because its oldParent archive condition disables the check for ordinary moves, allowing an authenticated editor or contributor to use _targetId and _position through the page REST update endpoint to move a controlled page into a restricted subtree and make nudgeNewPeers() updateMany re-rank protected sibling pages. This issue is fixed in version 4.32.0.