Description

ApostropheCMS is an open-source Node.js content management system. Prior to 4.32.0, the page module's move() operation fails to enforce the destination parent's _create permission because its oldParent archive condition disables the check for ordinary moves, allowing an authenticated editor or contributor to use _targetId and _position through the page REST update endpoint to move a controlled page into a restricted subtree and make nudgeNewPeers() updateMany re-rank protected sibling pages. This issue is fixed in version 4.32.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-17T20:16:44.870Z",
  "pubdate": "2026-08-17T20:16:44.870Z",
  "executiveSummary": "A privilege escalation and authorization bypass vulnerability exists within the page module of ApostropheCMS prior to version 4.32.0. The vulnerability resides in the move() operation, which fails to correctly enforce the destination parent's _create permission during page relocation requests.\nAn authenticated attacker with low-privileged roles such as an editor or contributor can exploit this flaw to manipulate the page tree hierarchy. By leveraging the page REST update endpoint with controlled parameters, an attacker can relocate a permitted page into a restricted subtree where they ordinarily lack creation and modification rights.\nSuccessful exploitation allows unauthorized manipulation of restricted content trees and leverages the nudgeNewPeers() updateMany routine to alter the ranking and ordering of protected sibling pages. The risk implications include unauthorized structural modifications, content tampering, and potential information disclosure or denial of layout integrity within restricted administrative areas.\nExploitation requires authenticated access to the application with standard editing privileges, meaning external unauthenticated attackers cannot directly trigger the vulnerability without prior credential compromise.",
  "technicalDetails": "The root cause of the vulnerability stems from flawed authorization logic inside the page module's move() operation within ApostropheCMS. Specifically, the implementation incorporates an oldParent archive condition that inadvertently disables the required destination parent permission check for ordinary move operations.\nThe vulnerable component is the page REST update endpoint and its underlying move handling logic, which processes user-supplied input for structural page reorganizations. Affected versions include all deployments of ApostropheCMS prior to version 4.32.0.\nAuthentication and privilege requirements dictate that the attacker must possess an authenticated session with at least editor or contributor privileges. The vulnerability is exploitable via standard network exposure where the CMS REST API is accessible to authenticated users.\nThe step-by-step attack flow proceeds as follows: First, the authenticated attacker identifies a restricted subtree within the ApostropheCMS page hierarchy where they do not possess _create permissions. Second, the attacker formulates an HTTP request to the page REST update endpoint. Third, the attacker supplies malicious or unauthorized values for the _targetId and _position parameters within the payload. Fourth, due to the missing permission validation caused by the oldParent archive condition check bypass, the move() operation processes the request and relocates the attacker-controlled page into the restricted subtree. Finally, the internal nudgeNewPeers() function executes an updateMany operation that recalculates and re-ranks the protected sibling pages residing in the destination subtree.\nPost-exploitation impact includes unauthorized alteration of the site architecture, bypassing access control lists governing restricted pages, and corrupting the sibling page ordering mechanism managed by nudgeNewPeers()."
}