{"id":"EUVD-2026-60438","revision":"2d5b33a26916430a849c03697ec27b40","records":[{"revision":"2d5b33a26916430a849c03697ec27b40","observedAt":"2026-11-01T11:28:30.718+00:00","statement":{"source":"euvd","id":"EUVD-2026-60438","aliases":["CVE-2026-63669","GHSA-wr5r-wqp2-x4fh"],"title":"ApostropheCMS is an open-source Node.js content management system. Prior to 4.32.0, the page module's move() operation fails to enforce the destination parent's _create permission because its oldParent archive condition disables the check f…","description":"ApostropheCMS is an open-source Node.js content management system. Prior to 4.32.0, the page module's move() operation fails to enforce the destination parent's _create permission because its oldParent archive condition disables the check for ordinary moves, allowing an authenticated editor or contributor to use _targetId and _position through the page REST update endpoint to move a controlled page into a restricted subtree and make nudgeNewPeers() updateMany re-rank protected sibling pages. This issue is fixed in version 4.32.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","score":6.5,"severity":null}],"references":["https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-wr5r-wqp2-x4fh","https://github.com/apostrophecms/apostrophe/commit/d50c6ad61b9c1788958752358f1fca714cc8368c"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-60438","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 17, 2026, 7:41:52 PM","dateUpdated":"Aug 17, 2026, 10:01:18 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-60438","identifiers":["EUVD-2026-60438","CVE-2026-63669","GHSA-wr5r-wqp2-x4fh"]},"retained":false,"historicalAffected":[]}],"coverage":[]}