CVE-2026-63669: ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtree
ApostropheCMS is an open-source Node.js content management system. Prior to 4.32.0, the page module's move() operation fails to enforce the destination parent's create permission because its oldParent archive condition disables the check for ordinary moves, allowing an authenticated editor or contributor to use targetId and position through the page REST update endpoint to move a controlled page into a restricted subtree and make nudgeNewPeers() updateMany re-rank protected sibling pages. This issue is fixed in version 4.32.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ApostropheCMSto a version that resolves this vulnerability.Fixed in 4.32.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63669?
The severity of CVE-2026-63669 is rated medium with a score of 6.5.
How do I fix CVE-2026-63669?
To fix CVE-2026-63669, upgrade ApostropheCMS to version 4.32.0 or later.
What is the risk of CVE-2026-63669?
CVE-2026-63669 has a risk score of 38, indicating a moderate level of concern for affected systems.
Who is affected by CVE-2026-63669?
Authenticated editors with low privileges in ApostropheCMS prior to version 4.32.0 are affected by CVE-2026-63669.
What does CVE-2026-63669 exploit?
CVE-2026-63669 exploits a missing authorization check in the page module's move() operation, allowing unauthorized page moves and re-rankings.