CVE-2026-113655
Deferred Deferred - Pending Action

ApostropheCMS Sibling Rank Bypass via Page Move

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: GitHub, Inc.

Description
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an authenticated editor with legitimate edit rights on a pre-existing ordinary page nested under a restricted parent can use the same-parent page move operation to change sibling ranks without create authorization on that parent. The non-default nesting must already exist, and the bypass is limited to sibling ordering rather than arbitrary content modification, confidentiality loss, or creation of the restricted nesting. This issue is fixed in version 4.33.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-11-09
AI Q&A
2026-10-20
EPSS Evaluated
2026-11-08
NVD
CVE-2026-113655
EUVD
EUVD-2026-105183

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apostrophecms apostrophe < 4.33.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ApostropheCMS versions before 4.33.0 have a vulnerability where an authenticated editor with edit rights on an ordinary page can reorder sibling pages under a restricted parent without proper authorization. This happens because the move operation skips authorization checks when moving pages within the same parent, allowing attackers to change the sibling ordering of restricted pages.

Detection Guidance

To detect this vulnerability, check if your ApostropheCMS instance is running a version prior to 4.33.0. Use commands like 'npm list apostrophecms' or inspect the package.json file to verify the installed version. If the version is below 4.33.0, the system is vulnerable.

Impact Analysis

This vulnerability allows attackers to modify the navigation order of pages they have no authority to edit, potentially exposing sensitive information or violating access controls. It requires only standard editor privileges and no special tokens, making it accessible to low-privileged users.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, violating integrity and authorization boundaries. It may result in non-compliance with GDPR or HIPAA if it leads to data exposure or unauthorized changes to restricted content.

Mitigation Strategies

Upgrade ApostropheCMS to version 4.33.0 or later to address the same-parent page reorder vulnerability. Ensure all instances are updated to prevent unauthorized sibling rank modifications under restricted parents.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113655. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...