CVE-2026-113655

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.33.0

Description An authenticated editor with legitimate edit rights on a page nested under a restricted parent can manipulate the sibling ordering of other pages under that same parent. This occurs because the move() function in the @apostrophecms/page module fails to enforce create authorization when a page is repositioned among its existing siblings (same-parent reorder), bypassing the checks required for cross-parent moves. This allows a low-privileged user to trigger an unguarded bulk database write via the nudgeNewPeers() function, which modifies the rank variable of sibling documents without verifying the editor's authority over them. This issue is reachable via the PATCH /api/v1/@apostrophecms/page/<myPageId>:en:draft endpoint using the targetId and position parameters.

Recommendations Update to version 4.33.0. As a temporary mitigation, avoid nesting editor-editable pages beneath restricted-type parents. Restrict the use of the targetId and position parameters in the /api/v1/@apostrophecms/page/ endpoint for users without administrative privileges.