CVE-2026-63669

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.32.0

Description The page module's move() operation fails to enforce the create permission of the destination parent. This occurs because the oldParent archive condition disables the check for ordinary moves. Consequently, an authenticated editor or contributor can utilize the targetId and position variables via the page REST update endpoint to move a page they control into a restricted subtree. This action allows the nudgeNewPeers() function's updateMany operation to re-rank protected sibling pages.

Recommendations Update to version 4.32.0.