The vulnerability is a missing authorization check during the page move operation in Apostrophe CMS. When an authenticated editor or contributor calls the page REST update endpoint with the _targetId and _position fields, the system does not verify that the destination parent has the required _create permission. This allows a low-privileged user to relocate a page into a restricted subtree and adjust the ordering of protected sibling pages. The result is an unauthorized alteration of content hierarchy that can expose or reorganize pages that were meant to be protected.

All instances of ApostropheCMS built on versions earlier than 4.32.0 are affected. The issue is specific to the page module’s move() function and impacted any configuration where restricted subtrees exist. Users are advised to consult the version history to confirm that their deployment is running an affected release.

The CVSS base score of 6.5 indicates a moderate severity vulnerability that could lead to a significant privacy or integrity compromise. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog, suggesting that known exploitation is not yet documented. The likely attack vector is an authenticated user with editor or contributor rights exploiting the REST API. No special conditions beyond having the appropriate role and the ability to send update requests are required, making the exploitation relatively straightforward for an insider or compromised account.