{"id":"EUVD-2026-60438","enisaUuid":"5c2c15c0-e3fe-3830-87b7-aa6521a75780","description":"ApostropheCMS is an open-source Node.js content management system. Prior to 4.32.0, the page module\u0027s move() operation fails to enforce the destination parent\u0027s _create permission because its oldParent archive condition disables the check for ordinary moves, allowing an authenticated editor or contributor to use _targetId and _position through the page REST update endpoint to move a controlled page into a restricted subtree and make nudgeNewPeers() updateMany re-rank protected sibling pages. This issue is fixed in version 4.32.0.","datePublished":"Aug 17, 2026, 7:41:52 PM","dateUpdated":"Aug 17, 2026, 10:01:18 PM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-wr5r-wqp2-x4fh\nhttps://github.com/apostrophecms/apostrophe/commit/d50c6ad61b9c1788958752358f1fca714cc8368c\n","aliases":"CVE-2026-63669\nGHSA-wr5r-wqp2-x4fh\n","assigner":"GitHub_M","epss":0.31,"enisaIdProduct":[{"id":"5e4dad07-0eb5-39ff-824f-caa7eca000ba","product":{"name":"Apostrophe ","vendor":{"name":"apostrophecms"}},"product_version":"\u003c 4.32.0"}],"enisaIdVendor":[{"id":"28d0a11b-3b1e-3c07-9214-781569fdda60","vendor":{"name":"apostrophecms"}}],"enisaIdVulnerability":[{"id":"5a109a52-64d2-313f-8a21-9d7af16a1b90","vulnerability":{"id":"GHSA-wr5r-wqp2-x4fh","description":"ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtree","datePublished":"Sep 3, 2026, 8:05:08 PM","dateUpdated":"Sep 3, 2026, 8:05:08 PM","baseScore":0.0,"references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-wr5r-wqp2-x4fh\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-63669\nhttps://github.com/apostrophecms/apostrophe/commit/d50c6ad61b9c1788958752358f1fca714cc8368c\nhttps://github.com/apostrophecms/apostrophe\n","enisa_id":"EUVD-2026-60438\n","aliases":"CVE-2026-63669\nGHSA-wr5r-wqp2-x4fh\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:00:27 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"d5cd31d4-d4a3-3645-91c7-93f64beb7542","vulnerability":{"id":"CVE-2026-63669","description":"ApostropheCMS is an open-source Node.js content management system. Prior to 4.32.0, the page module\u0027s move() operation fails to enforce the destination parent\u0027s _create permission because its oldParent archive condition disables the check for ordinary moves, allowing an authenticated editor or contributor to use _targetId and _position through the page REST update endpoint to move a controlled page into a restricted subtree and make nudgeNewPeers() updateMany re-rank protected sibling pages. This issue is fixed in version 4.32.0.","datePublished":"Aug 17, 2026, 7:41:52 PM","dateUpdated":"Aug 17, 2026, 10:01:18 PM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-wr5r-wqp2-x4fh\nhttps://github.com/apostrophecms/apostrophe/commit/d50c6ad61b9c1788958752358f1fca714cc8368c\n","enisa_id":"EUVD-2026-60438\n","assigner":"GitHub_M","epss":0.31,"dataProcessed":"Oct 30, 2026, 7:15:53 AM","vulnerabilityProduct":[{"id":"582e65ab-f6e9-3f55-b443-e8cfabe2f545","product":{"name":"Apostrophe ","vendor":{"name":"apostrophecms"}},"product_version":"\u003c 4.32.0"}],"vulnerabilityVendor":[{"id":"aa16513a-403d-3569-9d03-d6c632064ec4","vendor":{"name":"apostrophecms"}}]}}],"enisaIdAdvisory":[]}