Access Control Bypass in ApostropheCMS by Apostrophe

CVE-2026-113655

What is CVE-2026-113655?

ApostropheCMS, an open-source Node.js content management system, is susceptible to an access control bypass issue. Authenticated editors with legitimate edit rights on a pre-existing ordinary page, which is nested under a restricted parent, can exploit a flaw that permits them to manipulate sibling ranks using the same-parent page move operation. This bypass, however, is limited to changing sibling order and does not extend to unauthorized content modification, violation of confidentiality, or creation of restricted nesting. The issue has been addressed in version 4.33.0 of ApostropheCMS.

References