CVE-2026-113655: ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an authenticated editor with legitimate edit rights on a pre-existing ordinary page nested under a restricted parent can use the same-parent page move operation to change sibling ranks without create authorization on that parent. The non-default nesting must already exist, and the bypass is limited to sibling ordering rather than arbitrary content modification, confidentiality loss, or creation of the restricted nesting. This issue is fixed in version 4.33.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ApostropheCMSto a version that resolves this vulnerability.Fixed in 4.33.0
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Deployments are exposed if they use ApostropheCMS before 4.33.0 and have an existing, non-default page hierarchy in which ordinary pages are nested beneath a restricted parent. An authenticated editor must have edit rights to one of those pre-existing child pages.
What can an attacker do with the missing authorization check?
The editor can use a same-parent page move to change the ordering of sibling pages under the restricted parent, despite lacking create authorization there. The issue does not allow arbitrary content modification, confidentiality loss, or creation of the restricted nesting.
Are default configurations affected?
The affected nesting is explicitly non-default and must already exist. A deployment without ordinary pages already nested under a restricted parent does not meet the described precondition.
What is the remediation?
Upgrade ApostropheCMS to version 4.33.0, which fixes the issue. If upgrading cannot happen immediately, restrict edit access to ordinary pages beneath restricted parents or avoid allowing same-parent moves for those pages.