CVE-2026-63669
Received Received - Intake

Cross-Site Request Forgery in ApostropheCMS

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: GitHub, Inc.

Description
ApostropheCMS is an open-source Node.js content management system. Prior to 4.32.0, the page module's move() operation fails to enforce the destination parent's _create permission because its oldParent archive condition disables the check for ordinary moves, allowing an authenticated editor or contributor to use _targetId and _position through the page REST update endpoint to move a controlled page into a restricted subtree and make nudgeNewPeers() updateMany re-rank protected sibling pages. This issue is fixed in version 4.32.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-18
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-63669
EUVD
EUVD-2026-60438

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
apostrophecms apostrophe to 4.32.0 (exc)
apostrophecms apostrophe 4.32.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ApostropheCMS versions before 4.32.0 have a flaw in the page move operation that allows low-privileged users like editors or contributors to bypass permission checks. By manipulating parameters in the REST API, they can move pages into restricted sections and reorder protected sibling pages without proper authorization.

Detection Guidance

Check ApostropheCMS version with npm list apostrophe or grep package.json. Inspect REST API logs for unusual PATCH/PUT requests to /api/v1/@apostrophecms/page/:_id with _targetId and _position parameters. Review page move operations in admin logs for unauthorized subtree relocations.

Impact Analysis

An attacker with basic editing rights could move their pages into admin-only sections, disrupting site structure or exposing sensitive content. They could also reorder protected pages, potentially changing navigation or visibility of restricted content.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, violating GDPR's data integrity principles or HIPAA's access controls. Unauthorized page moves might expose restricted content, risking compliance breaches.

Mitigation Strategies

Upgrade ApostropheCMS to version 4.32.0 or later immediately. Temporarily restrict editor/contributor roles from using page move functions until upgrade completes. Monitor API endpoints for suspicious _targetId and _position parameter usage in page update requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63669. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart