{"id":"CVE-2026-63669","title":"ApostropheCMS is an open-source Node.js content management system","summary":"ApostropheCMS is an open-source Node.js content management system. Prior to 4.32.0, the page module's move() operation fails to enforce the destination parent's _create permission because its oldParent archive condition disables the chec…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","cwe":["CWE-639","CWE-862"],"vendor":"apostrophe","product":"apostrophe","affected":["apostrophe <= 4.31.0"],"patched":["apostrophe 4.32.0"],"published":"2026-08-17","updated":"2026-09-09","sourceUpdated":"2026-09-09T21:11:46.833","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63669","references":[{"url":"https://github.com/apostrophecms/apostrophe/commit/d50c6ad61b9c1788958752358f1fca714cc8368c","label":"security-advisories@github.com"},{"url":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-wr5r-wqp2-x4fh","label":"security-advisories@github.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63669"},{"url":"https://github.com/advisories/GHSA-wr5r-wqp2-x4fh"}],"tags":["nvd","ghsa","npm"],"epss":0.00221,"epssPercentile":0.12842,"aliases":["GHSA-wr5r-wqp2-x4fh"],"ecosystem":"npm","ingestedAt":"2026-09-03T20:08:06.495Z","slug":"CVE-2026-63669","body":"## Overview\n\nApostropheCMS is an open-source Node.js content management system. Prior to 4.32.0, the page module's move() operation fails to enforce the destination parent's _create permission because its oldParent archive condition disables the check for ordinary moves, allowing an authenticated editor or contributor to use _targetId and _position through the page REST update endpoint to move a controlled page into a restricted subtree and make nudgeNewPeers() updateMany re-rank protected sibling pages. This issue is fixed in version 4.32.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-63669)\n\nAffected packages:\n\n- `apostrophe <= 4.31.0`\n\nPatched in:\n\n- `apostrophe 4.32.0`\n\nSource: https://github.com/advisories/GHSA-wr5r-wqp2-x4fh","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}