Unauthorized Page Movement in ApostropheCMS 4.32.0

CVE-2026-63669

What is CVE-2026-63669?

ApostropheCMS, an open-source Node.js content management system, contains a vulnerability in its page module that affects versions before 4.32.0. The issue arises from the move() operation, which does not correctly enforce permission checks on the destination parent when pages are moved. Specifically, the oldParent's archive condition circumvents necessary checks for typical moves, permitting authenticated users—such as editors and contributors—to leverage the _targetId and _position parameters via the page REST update endpoint. This oversight enables them to relocate controlled pages into restricted areas, triggering the nudgeNewPeers() function to re-rank protected sibling pages. This vulnerability was addressed in version 4.32.0.

References