CVE-2026-113655 apostrophecms CVE debrief

Who should care

Authenticated low-privileged editors and administrators of ApostropheCMS instances who manage or interact with pages under restricted parents should be aware of this vulnerability. They should review and update ApostropheCMS to version 4.33.0 or later, restrict editing rights for low-privileged editors, and monitor for unauthorized page reordering to mitigate potential risks. Additionally, they should assess their current deployment for exposure and plan a

Why it matters

Authenticated low-privileged editors may reposition pages under restricted parents, triggering unguarded database writes. This could lead to potential unauthorized database writes, elevation of privileges, and data integrity risks.

• Potential unauthorized database writes
• Elevation of privileges for low-privileged editors
• Data integrity risks due to unguarded database operations

Technical summary

The move() operation in @apostrophecms/page does not properly enforce create rights when reordering pages under a restricted parent, allowing low-privileged editors to trigger unguarded database writes. This issue arises because the destination-parent authorization check in move() is gated on the move being a cross-parent move. A same-parent reorder short-circuits that check entirely, so an authenticated low-privileged editor who holds edit rights on one ordinary page nested under a restricted parent can reposition it and, in doing so, trigger an unguarded bulk database write that re-ranks the restricted parent's other children.

Defensive priority

Authenticated low-privileged editors may reposition pages under restricted parents, triggering unguarded database writes.

Recommended defensive actions

• Review and update ApostropheCMS to version 4.33.0 or later
• Restrict editing rights for low-privileged editors
• Monitor for unauthorized page reordering
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability in ApostropheCMS. The issue arises from the move() operation in @apostrophecms/page, which does not properly enforce create rights when reordering pages under a restricted parent.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.