NPM: ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtree

NPM: ApostropheCMS: Missing destination-parent authorization in page move allows a low-privileged editor to move and re-rank pages inside a restricted subtree vulnerability discovered by ? in WordPress Npm apostrophe versions = 4.31.0...

EUVD-2026-60438

ApostropheCMS: Missing destination-parent authorization in page move allows a low-privileged editor to move and re-rank pages inside a restricted subtree...

ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtree

Summary ApostropheCMS enforces per-type authorization on pages: a page type may declare editRole / publishRole and the core @apostrophecms/archive-page does, so a project can have page-type subtrees that only higher-privileged roles are allowed to create or edit within. The move operation is...

GHSA-WR5R-WQP2-X4FH ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtree

Summary ApostropheCMS enforces per-type authorization on pages: a page type may declare editRole / publishRole and the core @apostrophecms/archive-page does, so a project can have page-type subtrees that only higher-privileged roles are allowed to create or edit within. The move operation is...

Authorization Bypass Through User-Controlled Key

Overview apostrophe is a content management system CMS for Node.js. It supports in-context editing, schema-driven content types, flexible widgets and a great deal more. This module contains everything necessary to build a website with ApostropheCMS. Affected versions of this package are vulnerabl...

CVE-2026-63669

ApostropheCMS is an open-source Node.js content management system. Prior to 4.32.0, the page module's move operation fails to enforce the destination parent's create permission because its oldParent archive condition disables the check for ordinary moves, allowing an authenticated editor or...

CVE-2026-63669 ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtree

ApostropheCMS is an open-source Node.js content management system. Prior to 4.32.0, the page module's move operation fails to enforce the destination parent's create permission because its oldParent archive condition disables the check for ordinary moves, allowing an authenticated editor or...

CVE-2026-63669

ApostropheCMS is an open-source Node.js content management system. Prior to 4.32.0, the page module's move operation fails to enforce the destination parent's create permission because its oldParent archive condition disables the check for ordinary moves, allowing an authenticated editor or...

CVE-2026-63669

In ApostropheCMS before 4.32.0, the page module's move() skips the destination parent's _create permission check due to an archive-condition bug, allowing an authenticated editor or contributor to move a page into a restricted subtree and re-rank protected sibling pages via nudgeNewPeers() update...

CVE-2026-63669 ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtree

ApostropheCMS is an open-source Node.js content management system. Prior to 4.32.0, the page module's move operation fails to enforce the destination parent's create permission because its oldParent archive condition disables the check for ordinary moves, allowing an authenticated editor or...

CVE-2026-63669 ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtree

ApostropheCMS is an open-source Node.js content management system. Prior to 4.32.0, the page module's move operation fails to enforce the destination parent's create permission because its oldParent archive condition disables the check for ordinary moves, allowing an authenticated editor or...

PT-2026-76761

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.32.0 Description The page module's move operation fails to enforce the create permission of the destination parent. This occurs because the oldParent archive condition disables the check for ordinary moves...

PT-2026-63976

Grav API Plugin Composer package getgrav/grav-plugin-api before 1.0.10 fails to properly validate the slug field in the POST /pages/route/move endpoint. PagesController::move sanitizes the slug only with ltrim$body'slug', '.', which strips leading periods but does not neutralize '/' or '..'...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003363)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003363 advisory. The tracewritebackdirtypage implementation in include/trace/events/writeback.h in the Linux kernel before 4.4 improperly interacts with mm/migrate.c, which allows...

EUVD-2016-4141

Malware in sbrugna...

Linux Distros Unpatched Vulnerability : CVE-2016-3070

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The tracewritebackdirtypage implementation in include/trace/events/writeback.h in the Linux kernel before 4.4 improperly interacts with mm/migrate.c, which allo...

BIT-MEDIAWIKI-2024-34506

An issue was discovered in includes/specials/SpecialMovePage.php in MediaWiki before 1.39.7, 1.40.x before 1.40.3, and 1.41.x before 1.41.1. If a user with the necessary rights to move the page opens Special:MovePage for a page with tens of thousands of subpages, then the page will exceed the...

SUSE CVE-2005-2215

Cross-site scripting XSS vulnerability in MediaWiki before 1.4.x before 1.4.6 and 1.5 before 1.5beta3 allows remote attackers to inject arbitrary web script or HTML via a parameter in the page move template, a different vulnerability than CVE-2005-1888...

SUSE CVE-2005-2396

Cross-site scripting XSS vulnerability in MediaWiki 1.4.6 and earlier allows remote attackers to inject arbitrary web script or HTML via a parameter to the page move template...

SUSE CVE-2016-3070

The tracewritebackdirtypage implementation in include/trace/events/writeback.h in the Linux kernel before 4.4 improperly interacts with mm/migrate.c, which allows local users to cause a denial of service NULL pointer dereference and system crash or possibly have unspecified other impact by...