TI-2026-45294 Aliases CVE-2026-63669 GHSA-wr5r-wqp2-x4fh

Authorization bypass in apostrophecms apostrophe

LOW 29CWE-639Published 2026-08-17 · Updated 2026-08-17

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: None · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-639.

Summary

ApostropheCMS is an open-source Node.js content management system. Prior to 4.32.0, the page module's move() operation fails to enforce the destination parent's _create permission because its oldParent archive condition disables the check for ordinary moves, allowing an authenticated editor or contributor to use _targetId and _position through the page REST update endpoint to move a controlled page into a restricted subtree and make nudgeNewPeers() updateMany re-rank protected sibling pages. This issue is fixed in version 4.32.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00311 24th percentileScored 2026-11-07

Fix Fixed apostrophe (apostrophecms): 4.32.0apostrophe (npm): 4.32.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
apostrophecms	apostrophe	before 4.32.0	4.32.0	Patch available	CNA
—	apostrophe (npm)	before 4.32.0	4.32.0	Patch available	GHSA-wr5r-wqp2-x4fh

apostrophe Vendorapostrophecms Affected before 4.32.0 Fixed in 4.32.0 Patch available CNA
apostrophe (npm) Vendor— Affected before 4.32.0 Fixed in 4.32.0 Patch available GHSA-wr5r-wqp2-x4fh

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:apostrophecms:apostrophecms::::::::	—	—	apostrophecms

cpe:2.3:a:apostrophecms:apostrophecms:*:*:*:*:*:*:*:* Versions — — ·apostrophecms

Remediation

Fix · CNA apostrophe (apostrophecms) Fixed in 4.32.0
Fix · GHSA-wr5r-wqp2-x4fh apostrophe (npm) Fixed in 4.32.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-63669
2026-10-03 Alias added: GHSA-wr5r-wqp2-x4fh

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-63669

Other 3

TI-2026-25223 ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction CVSS 3.1CRITICAL 10.0
TI-2026-32848 Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html` CVSS 3.1CRITICAL 9.3
TI-2026-38664 @apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag CVSS 3.1HIGH 8.7
TI-2026-27673 ApostropheCMS: Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS CVSS 3.1HIGH 8.7
TI-2026-76992 Unauthenticated resource exhaustion via ApostropheCMS import routes CVSS 3.1HIGH 7.5
TI-2026-76974 ApostropheCMS leaves rejected CSV uploads in temporary directory CVSS 3.1HIGH 7.5

See all 65 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences