# CVE-2026-113655: ApostropheCMS authorization bypass in page rank modification

Source: https://junglewise.ai/threats/cve-2026-113655-apostrophecms-is-an-open-source-node-js-content-management  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-20. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-113655 · Severity: medium · CVSS 4.3 · Published 2026-10-20

ApostropheCMS is an open-source Node.js content management system used for managing website content. An authenticated editor with edit rights on a page nested under a restricted section can bypass authorization controls to reorder sibling pages without proper create permissions on the parent section. This allows unauthorized manipulation of page hierarchy, though it does not permit creation of new restricted content or modification of page content itself.

Technologies: [ApostropheCMS Apostrophe](https://junglewise.ai/threats/technologies/apostrophecms-apostrophe), [apostrophe (npm)](https://junglewise.ai/threats/technologies/apostrophe). Vendors: [ApostropheCMS](https://junglewise.ai/threats/vendors/apostrophecms), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-113655 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-113655 being exploited in the wild.

**How severe is CVE-2026-113655?** Medium severity, with a CVSS score of 4.3, published 20 October 2026.

**Which products and versions are affected?** ApostropheCMS Apostrophe prior to 4.33.0; apostrophe (npm) < 4.33.0, SEMVER:introduced=0,fixed=4.33.0.

**Is there a fix for CVE-2026-113655?** Yes. apostrophe (npm): upgrade to 4.33.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-113655 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-113655?** Check whether you run ApostropheCMS Apostrophe or apostrophe (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- apostrophe (npm): upgrade to 4.33.0 or later

  ```sh
  npm install apostrophe@4.33.0
  ```


## Technical details

The vulnerability exists in the page move operation that allows reordering sibling pages. An authenticated editor can exploit the same-parent page move to change sibling ranks (ordering) on pages nested under a restricted parent, even when lacking create authorization on that parent. The attack requires pre-existing non-default nesting to already be present and is limited to sibling ordering operations rather than arbitrary content modification.

## Affected products

- ApostropheCMS Apostrophe prior to 4.33.0

## Identifiers

- CVE-2026-113655
- GHSA-2jrp-qc93-h2j8

## Timeline

- 2026-10-20: disclosed

## References

- [https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce](https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce)
- [https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350](https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350)

## Related threats

- [ApostropheCMS unauthenticated file upload in import routes](https://junglewise.ai/threats/cve-2026-113711-apostrophecms-is-an-open-source-node-js-content-management)
- [ApostropheCMS password-change endpoint lacks attempt throttling](https://junglewise.ai/threats/cve-2026-113710-apostrophecms-no-attempt-throttling-on-authenticated-password)
- [ApostropheCMS page REST API authorization bypass](https://junglewise.ai/threats/cve-2026-113670-apostrophecms-page-rest-api-authorization-bypass)
- [ApostropheCMS cross-domain session token in URL confers session takeover](https://junglewise.ai/threats/cve-2026-113669-apostrophecms-cross-domain-session-token-in-url-confers-session)
- [ApostropheCMS REST route authorization bypass in locales endpoint](https://junglewise.ai/threats/cve-2026-113668-apostrophecms-id-locales-rest-route-omits-the-public-api)