ApostropheCMS CVE-2026-113655

Requires an authenticated user with legitimate editor-level edit rights (PR:L) on a pre-existing ordinary page that is already nested under a restricted parent. The non-default nesting arrangement MUST already exist - the flaw cannot create it. Exploitation is performed specifically through the same-parent page move operation, which fails to enforce create authorization on the parent. Limiting factors: valid editor credentials are mandatory, the restricted nesting must be pre-configured (non-default), and impact is confined to changing sibling ordering/ranks - not arbitrary content modification, data disclosure, or creation of the restricted nesting.

This is a low-to-moderate priority authorization flaw (CWE-639, IDOR-class) that the CVSS base score of 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) accurately reflects. Although the attack vector is network (AV:N) with low complexity (AC:L), exploitation requires legitimate authenticated editor privileges (PR:L) and, critically, a pre-existing non-default page nesting under a restricted parent - so this is not a broadly weaponizable issue. The impact is explicitly bounded: only low integrity (I:L) from reordering sibling page ranks, with no confidentiality (C:N), no availability (A:N), and no ability to create the restricted nesting or modify arbitrary content. No EPSS score, KEV listing, or public POC is present in the provided data; exploitation status is therefore 'no public exploit identified at time of analysis.' All signals are internally consistent - there is no network-vs-local contradiction, and the limited integrity impact matches the narrow description. This is a defense-in-depth authorization fix rather than an urgent, widely-exploitable vulnerability.

An insider or compromised account holding legitimate editor rights on an ordinary page that already sits under a restricted parent invokes the same-parent page move operation. Because the move path does not re-check create authorization on the parent, the editor reorders the ranks of sibling pages under that restricted parent despite lacking create rights there. No public exploit code is identified; abuse requires existing valid credentials and a pre-existing non-default nesting arrangement.