ApostropheCMS enforces per-type authorization on pages, including create and edit roles. The move() operation is intended to restrict moving pages only into parents where the user has create rights. However, a regression introduced in commit 9f72bd229be07e537a2ae894f4527f2fe6bcd3bd added a condition that gates the critical create permission check on the old parent being an archive page. For normal moves, this condition evaluates to false, effectively disabling the destination authorization check. Consequently, the only permission check is whether the user can edit the page being moved, which low-privileged editors can do for their own pages. This flaw allows moving pages under restricted parents without proper authorization. The move triggers an unguarded updateMany operation that re-ranks the restricted parent's children, modifying documents the user cannot edit. The vulnerability is exploitable via the documented REST API PATCH/PUT /api/v1/@apostrophecms/page/:_id route by controlling the _targetId and _position fields. The sibling insert route correctly enforces create permissions on the target, highlighting the regression in move().

An authenticated user with edit rights on at least one page can bypass intended authorization controls to move that page under a restricted parent page they do not have create or edit permissions for. This unauthorized move triggers an unchecked database update that re-ranks the restricted parent's children, potentially modifying documents the user is not authorized to edit. The vulnerability does not disclose content or escalate privileges directly but allows unauthorized modification of page hierarchy and ordering, which may impact content integrity and access control enforcement.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict edit permissions to trusted users only and monitor for suspicious use of the page move API. Avoid exposing the PATCH/PUT /api/v1/@apostrophecms/page/:_id endpoint to untrusted users if possible. Review and apply any official patches or updates from ApostropheCMS once released.