{"apiVersion":"1.0","identifier":"CVE-2026-63669","description":"ApostropheCMS is an open-source Node.js content management system. Prior to 4.32.0, the page module-s move() operation fails to enforce the destination parent-s _create permission because its oldParent archive condition disables the check for ordinary moves, allowing an authenticated editor or contributor to use _targetId and _position through the page REST update endpoint to move a controlled page into a restricted subtree and make nudgeNewPeers() updateMany re-rank protected sibling pages. This issue is fixed in version 4.32.0.","publishedAt":"2026-08-17T20:16:44","lastModifiedAt":"2026-08-17T22:17:16","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63669","cvssScore":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","epssProbability":0.00221,"riskScore":0.66,"affectedProduct":"ApostropheCMS","affectedVersions":"<4.32.0","vulnerabilityType":"Web app","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-63669","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-63669","en":"https://www.redsauce.net/en/cves/CVE-2026-63669","fr":"https://www.redsauce.net/fr/cves/CVE-2026-63669","pt":"https://www.redsauce.net/pt/cves/CVE-2026-63669","de":"https://www.redsauce.net/de/cves/CVE-2026-63669","sk":"https://www.redsauce.net/sk/cves/CVE-2026-63669","el":"https://www.redsauce.net/el/cves/CVE-2026-63669"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-63669"}}