https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 22:19:47 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-63669 <p>ApostropheCMS is an open-source Node.js content management system. Prior to 4.32.0, the page module&#39;s move() operation fails to enforce the destination parent&#39;s _create permission because its oldParent archive condition disables the check for ordinary moves, allowing an authenticated editor or contributor to use _targetId and _position through the page REST update endpoint to move a controlled page into a restricted subtree and make nudgeNewPeers() updateMany re-rank protected sibling pages. This issue is fixed in version 4.32.0.</p> <p>ApostropheCMS is an open-source Node.js content management system. Prior to 4.32.0, the page module&#39;s move() operation fails to enforce the destination parent&#39;s _create permission because its oldParent archive condition disables the check for ordinary moves, allowing an authenticated editor or contributor to use _targetId and _position through the page REST update endpoint to move a controlled page into a restricted subtree and make nudgeNewPeers() updateMany re-rank protected sibling pages. This issue is fixed in version 4.32.0.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-63669 https://vulnerability.circl.lu/vuln/ghsa-wr5r-wqp2-x4fh <p><strong>Affected:</strong> npm: apostrophe</p> <p>## Summary ApostropheCMS enforces per-type authorization on pages: a page type may declare `editRole` / `publishRole` (and the core `@apostrophecms/archive-page` does), so a project can have page-type subtrees that only higher-privileged roles are allowed to create or edit within. The `move()` operation is supposed to enforce that a page may only be moved *into* a parent the actor has **create** rights over — this is the same boundary the page-insert route enforces (the insert target is fetched with `.permission(&#39;create&#39;)`).</p> <p>A regression in the move authorization guard silently disabled that destination check for every normal move. The guard now reads `(oldParent._id !== parent._id) &amp;&amp; (parent.type !== &#39;@apostrophecms/archive-page&#39;) &amp;&amp; (!parent._create) &amp;&amp; (oldParent.type === &#39;@apostrophecms/archive-page&#39; &amp;&amp; !parent._edit)`. Because the final `&amp;&amp;` clause requires `oldParent.type === &#39;@apostrophecms/archive-page&#39;`, the whole conjunction can only be true while restoring a page *out of the archive*. For any ordinary move (the source page&#39;s old parent is a normal page), that clause is `false`, the entire condition is `false`, and `!parent._create` is never evaluated. The only surviving gate in the whole path is `moved._edit` — i.e. &#34;can the actor edit the page being moved&#34;, which a low-privileged editor legitimately holds for their own ordinary pages.</p> <p>The result is that any authenticated user who can edit at least one page can relocate that page **under a parent of a restricte…</p> <p><strong>Affected:</strong> npm: apostrophe</p> <p>## Summary ApostropheCMS enforces per-type authorization on pages: a page type may declare `editRole` / `publishRole` (and the core `@apostrophecms/archive-page` does), so a project can have page-type subtrees that only higher-privileged roles are allowed to create or edit within. The `move()` operation is supposed to enforce that a page may only be moved *into* a parent the actor has **create** rights over — this is the same boundary the page-insert route enforces (the insert target is fetched with `.permission(&#39;create&#39;)`).</p> <p>A regression in the move authorization guard silently disabled that destination check for every normal move. The guard now reads `(oldParent._id !== parent._id) &amp;&amp; (parent.type !== &#39;@apostrophecms/archive-page&#39;) &amp;&amp; (!parent._create) &amp;&amp; (oldParent.type === &#39;@apostrophecms/archive-page&#39; &amp;&amp; !parent._edit)`. Because the final `&amp;&amp;` clause requires `oldParent.type === &#39;@apostrophecms/archive-page&#39;`, the whole conjunction can only be true while restoring a page *out of the archive*. For any ordinary move (the source page&#39;s old parent is a normal page), that clause is `false`, the entire condition is `false`, and `!parent._create` is never evaluated. The only surviving gate in the whole path is `moved._edit` — i.e. &#34;can the actor edit the page being moved&#34;, which a low-privileged editor legitimately holds for their own ordinary pages.</p> <p>The result is that any authenticated user who can edit at least one page can relocate that page **under a parent of a restricte…</p> https://vulnerability.circl.lu/vuln/ghsa-wr5r-wqp2-x4fh