CVE-2026-113655: CWE-639: Authorization Bypass Through User-Controlled Key in apostrophecms apostrophe

CVE-2026-113655 describes an authorization bypass in ApostropheCMS before version 4.33.0. An authenticated editor with legitimate edit rights on an existing ordinary page nested under a restricted parent can exploit the same-parent page move operation to change the order of sibling pages. This operation bypasses the need for create authorization on the restricted parent. The vulnerability requires the restricted nesting to already exist and is limited to sibling ordering changes, without enabling arbitrary content modification, confidentiality breaches, or creation of new restricted content. The vulnerability is addressed in ApostropheCMS version 4.33.0.

The vulnerability allows an authenticated editor to reorder sibling pages under a restricted parent without proper create authorization. This results in an integrity impact limited to page ordering but does not affect confidentiality or availability. There is no known exploitation in the wild.

Upgrade ApostropheCMS to version 4.33.0 or later, where this authorization bypass vulnerability is fixed. No other mitigation is required as the issue is resolved in the official fix.