CyberRota Analysis
AI-GeneratedApostropheCMS versions prior to 4.32.0 are vulnerable due to a flaw in the page module's move() operation, which does not properly enforce permission checks when moving pages. This allows authenticated users, such as editors or contributors, to manipulate page hierarchy and potentially access or alter restricted content. Organizations using ApostropheCMS should prioritize updating to version 4.32.0 to mitigate the risk of unauthorized content manipulation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ApostropheCMS is an open-source Node.js content management system. Prior to 4.32.0, the page module's move() operation fails to enforce the destination parent's _create permission because its oldParent archive condition disables the check for ordinary moves, allowing an authenticated editor or contributor to use _targetId and _position through the page REST update endpoint to move a controlled page into a restricted subtree and make nudgeNewPeers() updateMany re-rank protected sibling pages. This issue is fixed in version 4.32.0.