ApostropheCMS allows an authenticated editor who can normally edit a page nested under a restricted parent to reorder that page and its siblings by using the same‑parent move operation. The operation bypasses the create authorization check that normally applies when moving children under a restricted parent. This flaw does not allow arbitrary content creation or modification but does let a user modify sibling ordering inside a restricted area, effectively lifting a permission that should be bound to the parent.

The vulnerability exists in ApostropheCMS versions prior to 4.33.0. All releases that include the page move functionality before the 4.33.0 fix are impacted. Users of ApostropheCMS should verify their installed version and consider it vulnerable if it precedes 4.33.0.

The CVSS score of 4.3 indicates a low‑to‑medium severity. No EPSS score is available, and the issue is not in the CISA KEV catalog. Attack requires authenticated access with edit rights on a nested page and relies on using the same‑parent page move API; it is not exploitable without valid credentials, but it does allow elevation of authorization within the CMS. The potential impact is limited to ordering changes within a restricted hierarchy rather than full content modification or confidentiality loss.