CVE-2026-113655: ApostropheCMS authorization bypass in page rank modification

CVE-2026-113655 · Severity: medium · CVSS 4.3 · Published 2026-10-20

ApostropheCMS is an open-source Node.js content management system used for managing website content. An authenticated editor with edit rights on a page nested under a restricted section can bypass authorization controls to reorder sibling pages without proper create permissions on the parent section. This allows unauthorized manipulation of page hierarchy, though it does not permit creation of new restricted content or modification of page content itself.

Technologies: ApostropheCMS Apostrophe, apostrophe (npm). Vendors: ApostropheCMS, npm.

Quick answers

Is CVE-2026-113655 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-113655 being exploited in the wild.
How severe is CVE-2026-113655?
Medium severity, with a CVSS score of 4.3, published 20 October 2026.
Which products and versions are affected?
ApostropheCMS Apostrophe prior to 4.33.0; apostrophe (npm) < 4.33.0, SEMVER:introduced=0,fixed=4.33.0.
Is there a fix for CVE-2026-113655?
Yes. apostrophe (npm): upgrade to 4.33.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-113655 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-113655?
Check whether you run ApostropheCMS Apostrophe or apostrophe (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • apostrophe (npm): upgrade to 4.33.0 or later
    npm install apostrophe@4.33.0

Technical details

The vulnerability exists in the page move operation that allows reordering sibling pages. An authenticated editor can exploit the same-parent page move to change sibling ranks (ordering) on pages nested under a restricted parent, even when lacking create authorization on that parent. The attack requires pre-existing non-default nesting to already be present and is limited to sibling ordering operations rather than arbitrary content modification.

Affected products

  • ApostropheCMS Apostrophe prior to 4.33.0

Identifiers

  • CVE-2026-113655
  • GHSA-2jrp-qc93-h2j8

Timeline

  • 2026-10-20: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.