CVE-2026-63669

ApostropheCMS is an open-source Node.js content management system. Prior to 4.32.0, the page module's move() operation fails to enforce the destination parent's _create permission because its oldParent archive condition disables the check for ordinary moves, allowing an authenticated editor or contributor to use _targetId and _position through the page REST update endpoint to move a controlled page into a restricted subtree and make nudgeNewPeers() updateMany re-rank protected sibling pages. This issue is fixed in version 4.32.0.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/apostrophecms/apostrophe/commit/d50c6ad61b9c1788958752358f1fca714cc8368c
https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-wr5r-wqp2-x4fh

Configurations

No configuration.

History

23 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) ApostropheCMS es un sistema de gestión de contenido de código abierto de Node.js. Antes de la versión 4.32.0, la operación move() del módulo de página no logra hacer cumplir el permiso _create del padre de destino porque su condición de archivo oldParent deshabilita la verificación para movimientos ordinarios, permitiendo que un editor o colaborador autenticado use _targetId y _position a través del endpoint de actualización REST de página para mover una página controlada a un subárbol restringido y hacer que nudgeNewPeers() updateMany reordene las páginas hermanas protegidas. Este problema se solucionó en la versión 4.32.0.

Information

Published : 2026-08-17 20:16

Updated : 2026-10-23 16:10

NVD link : CVE-2026-63669

Mitre link : CVE-2026-63669

CVE.ORG link : CVE-2026-63669

JSON object : View

Products Affected

No product.

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

CWE-862

Missing Authorization

{"id": "CVE-2026-63669", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63669", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-17T21:29:08.295154Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "apostrophecms", "product": "apostrophe", "versions": [{"status": "affected", "version": "< 4.32.0"}]}]}], "published": "2026-08-17T20:16:44.870", "references": [{"url": "https://github.com/apostrophecms/apostrophe/commit/d50c6ad61b9c1788958752358f1fca714cc8368c", "source": "security-advisories@github.com"}, {"url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-wr5r-wqp2-x4fh", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-639"}, {"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "ApostropheCMS is an open-source Node.js content management system. Prior to 4.32.0, the page module's move() operation fails to enforce the destination parent's _create permission because its oldParent archive condition disables the check for ordinary moves, allowing an authenticated editor or contributor to use _targetId and _position through the page REST update endpoint to move a controlled page into a restricted subtree and make nudgeNewPeers() updateMany re-rank protected sibling pages. This issue is fixed in version 4.32.0."}, {"lang": "es", "value": "ApostropheCMS es un sistema de gesti\u00f3n de contenido de c\u00f3digo abierto de Node.js. Antes de la versi\u00f3n 4.32.0, la operaci\u00f3n move() del m\u00f3dulo de p\u00e1gina no logra hacer cumplir el permiso _create del padre de destino porque su condici\u00f3n de archivo oldParent deshabilita la verificaci\u00f3n para movimientos ordinarios, permitiendo que un editor o colaborador autenticado use _targetId y _position a trav\u00e9s del endpoint de actualizaci\u00f3n REST de p\u00e1gina para mover una p\u00e1gina controlada a un sub\u00e1rbol restringido y hacer que nudgeNewPeers() updateMany reordene las p\u00e1ginas hermanas protegidas. Este problema se solucion\u00f3 en la versi\u00f3n 4.32.0."}], "lastModified": "2026-10-23T16:10:00.313", "sourceIdentifier": "security-advisories@github.com"}