CVE-2026-113655 ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an authenticated editor with legitimate edit rights on a pre-existing ordinary page nested under a restricted parent can use the same-parent page move operation to change sibling ranks without create authorization...

CVE-2026-113655

Prior to version 4.33.0 , ApostropheCMS (a Node.js CMS) is vulnerable to an authorization bypass in the @apostrophecms/page move() function. An authenticated editor with legitimate edit rights on an ordinary page nested under a restricted parent can use a same-parent page move operation to re-ran...

CVE-2026-113655 ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an authenticated editor with legitimate edit rights on a pre-existing ordinary page nested under a restricted parent can use the same-parent page move operation to change sibling ranks without create authorization...