Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
14 vulnerabilities found for django-cms by django-cms
CVE-2026-75526 (GCVE-0-2026-75526)
Vulnerability from nvd – Published: 2026-08-20 18:11 – Updated: 2026-08-20 19:20
VLAI
EPSS
VEX
Title
django CMS: Stored XSS in edit-mode plugin exception rendering
Summary
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. From 5.0.8 until 5.0.9, ContentRenderer.render_placeholder in cms/plugin_rendering.py can pass stored, attacker-controlled values to ContentRenderer.render_exception when plugin rendering fails in edit mode. Values from get_short_description(), the exception message, the placeholder, or placeholder.source are interpolated into a cms-rendering-exception heading and later returned through mark_safe. Because the heading is not escaped, stored HTML executes in an editor’s browser, and settings.DEBUG does not prevent the custom heading from rendering. The fix uses format_html to escape the message before safe placeholder output is returned. This issue is fixed in versions 5.0.9.
Severity
4.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 19:20 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/django-cms/django-cms/security… | x_refsource_CONFIRM |
| https://github.com/django-cms/django-cms/pull/8711 | x_refsource_MISC |
| https://github.com/django-cms/django-cms/commit/b… | x_refsource_MISC |
| https://github.com/django-cms/django-cms/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| django-cms | django-cms |
Affected:
>= 5.0.8, < 5.0.9
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-75526",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T19:20:47.120348Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T19:20:52.755Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "django-cms",
"vendor": "django-cms",
"versions": [
{
"status": "affected",
"version": "\u003e= 5.0.8, \u003c 5.0.9"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. From 5.0.8 until 5.0.9, ContentRenderer.render_placeholder in cms/plugin_rendering.py can pass stored, attacker-controlled values to ContentRenderer.render_exception when plugin rendering fails in edit mode. Values from get_short_description(), the exception message, the placeholder, or placeholder.source are interpolated into a cms-rendering-exception heading and later returned through mark_safe. Because the heading is not escaped, stored HTML executes in an editor\u2019s browser, and settings.DEBUG does not prevent the custom heading from rendering. The fix uses format_html to escape the message before safe placeholder output is returned. This issue is fixed in versions 5.0.9."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T18:11:10.220Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/django-cms/django-cms/security/advisories/GHSA-hvq6-2r72-p2x7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/django-cms/django-cms/security/advisories/GHSA-hvq6-2r72-p2x7"
},
{
"name": "https://github.com/django-cms/django-cms/pull/8711",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/django-cms/django-cms/pull/8711"
},
{
"name": "https://github.com/django-cms/django-cms/commit/b56a568844ff3702495945f73a31d0868285bf88",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/django-cms/django-cms/commit/b56a568844ff3702495945f73a31d0868285bf88"
},
{
"name": "https://github.com/django-cms/django-cms/releases/tag/5.0.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/django-cms/django-cms/releases/tag/5.0.9"
}
],
"source": {
"advisory": "GHSA-hvq6-2r72-p2x7",
"discovery": "UNKNOWN"
},
"title": "django CMS: Stored XSS in edit-mode plugin exception rendering"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-75526",
"datePublished": "2026-08-20T18:11:10.220Z",
"dateReserved": "2026-08-17T20:49:21.600Z",
"dateUpdated": "2026-08-20T19:20:52.755Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63003 (GCVE-0-2026-63003)
Vulnerability from nvd – Published: 2026-08-20 18:09 – Updated: 2026-08-21 21:46
VLAI
EPSS
VEX
Title
django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)
Summary
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, page duplication lacks an object-level authorization check on the source page. In cms/admin/forms.py, DuplicatePageForm.source accepts any Page, the AddPageForm constructor does not narrow a hidden source field, AddPageForm.clean does not validate the source against the user, and AddPageForm.save calls from_source. In cms/admin/pageadmin.py, duplicate and PageAdmin.has_add_permission check only whether a staff user may add a page. A crafted source value can therefore copy every placeholder and plugin from an unauthorized page with permissions=False, stripping source view restrictions and exposing content across sites or restricted subtrees when CMS_PERMISSION is enabled. This issue is fixed in versions 5.0.9.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 20:58 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/django-cms/django-cms/security… | x_refsource_CONFIRM |
| https://github.com/django-cms/django-cms/pull/8713 | x_refsource_MISC |
| https://github.com/django-cms/django-cms/commit/3… | x_refsource_MISC |
| https://github.com/django-cms/django-cms/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| django-cms | django-cms |
Affected:
< 5.0.9
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63003",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T20:58:41.902595Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T21:46:19.864Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "django-cms",
"vendor": "django-cms",
"versions": [
{
"status": "affected",
"version": "\u003c 5.0.9"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, page duplication lacks an object-level authorization check on the source page. In cms/admin/forms.py, DuplicatePageForm.source accepts any Page, the AddPageForm constructor does not narrow a hidden source field, AddPageForm.clean does not validate the source against the user, and AddPageForm.save calls from_source. In cms/admin/pageadmin.py, duplicate and PageAdmin.has_add_permission check only whether a staff user may add a page. A crafted source value can therefore copy every placeholder and plugin from an unauthorized page with permissions=False, stripping source view restrictions and exposing content across sites or restricted subtrees when CMS_PERMISSION is enabled. This issue is fixed in versions 5.0.9."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T18:09:13.988Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/django-cms/django-cms/security/advisories/GHSA-6x92-6vx4-5fwr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/django-cms/django-cms/security/advisories/GHSA-6x92-6vx4-5fwr"
},
{
"name": "https://github.com/django-cms/django-cms/pull/8713",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/django-cms/django-cms/pull/8713"
},
{
"name": "https://github.com/django-cms/django-cms/commit/3e1ccf7573eb1a74ebbbfaaa812c1f5cadf14e6c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/django-cms/django-cms/commit/3e1ccf7573eb1a74ebbbfaaa812c1f5cadf14e6c"
},
{
"name": "https://github.com/django-cms/django-cms/releases/tag/5.0.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/django-cms/django-cms/releases/tag/5.0.9"
}
],
"source": {
"advisory": "GHSA-6x92-6vx4-5fwr",
"discovery": "UNKNOWN"
},
"title": "django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-63003",
"datePublished": "2026-08-20T18:09:13.988Z",
"dateReserved": "2026-07-14T23:10:57.032Z",
"dateUpdated": "2026-08-21T21:46:19.864Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-61663 (GCVE-0-2026-61663)
Vulnerability from nvd – Published: 2026-08-20 18:07 – Updated: 2026-08-20 18:07
VLAI
EPSS
VEX
Title
django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff
Summary
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, render_object_structure fails to authorize non-PageContent objects that use PlaceholderRelationField. An active staff user without cms.use_structure or model-level view or change permission can request the //admin/cms/placeholder/object/<content_type_id>/structure/<object_id>/ endpoint with guessed content_type_id and object_id values. The response discloses placeholder slot names, plugin trees, plugin identifiers, labels, and object existence for frontend-editable objects. The fix applies user_can_view_placeholder_source to the non-PageContent branch while keeping the structure board read-only for view-only users. This issue is fixed in versions 5.0.9.
Severity
4.3 (Medium)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/django-cms/django-cms/security… | x_refsource_CONFIRM |
| https://github.com/django-cms/django-cms/pull/8703 | x_refsource_MISC |
| https://github.com/django-cms/django-cms/commit/9… | x_refsource_MISC |
| https://github.com/django-cms/django-cms/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| django-cms | django-cms |
Affected:
< 5.0.9
|
{
"containers": {
"cna": {
"affected": [
{
"product": "django-cms",
"vendor": "django-cms",
"versions": [
{
"status": "affected",
"version": "\u003c 5.0.9"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, render_object_structure fails to authorize non-PageContent objects that use PlaceholderRelationField. An active staff user without cms.use_structure or model-level view or change permission can request the //admin/cms/placeholder/object/\u003ccontent_type_id\u003e/structure/\u003cobject_id\u003e/ endpoint with guessed content_type_id and object_id values. The response discloses placeholder slot names, plugin trees, plugin identifiers, labels, and object existence for frontend-editable objects. The fix applies user_can_view_placeholder_source to the non-PageContent branch while keeping the structure board read-only for view-only users. This issue is fixed in versions 5.0.9."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T18:07:28.005Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/django-cms/django-cms/security/advisories/GHSA-8qj2-c6q4-f399",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/django-cms/django-cms/security/advisories/GHSA-8qj2-c6q4-f399"
},
{
"name": "https://github.com/django-cms/django-cms/pull/8703",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/django-cms/django-cms/pull/8703"
},
{
"name": "https://github.com/django-cms/django-cms/commit/9c82abfeb25471583e23906ea1ebef9202527b04",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/django-cms/django-cms/commit/9c82abfeb25471583e23906ea1ebef9202527b04"
},
{
"name": "https://github.com/django-cms/django-cms/releases/tag/5.0.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/django-cms/django-cms/releases/tag/5.0.9"
}
],
"source": {
"advisory": "GHSA-8qj2-c6q4-f399",
"discovery": "UNKNOWN"
},
"title": "django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-61663",
"datePublished": "2026-08-20T18:07:28.005Z",
"dateReserved": "2026-07-10T18:25:21.467Z",
"dateUpdated": "2026-08-20T18:07:28.005Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54624 (GCVE-0-2026-54624)
Vulnerability from nvd – Published: 2026-08-20 18:04 – Updated: 2026-08-20 19:46
VLAI
EPSS
VEX
Title
django CMS: Structure endpoint bypasses page-view permission
Summary
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, render_object_structure in cms/views.py renders cms/toolbar/structure.html for a PageContent object without calling user_can_view_page(). Any staff account can request a restricted page’s structure when CMS_PERMISSION is enabled and the page has view restrictions or CMS_PUBLIC_FOR is set to staff. The response exposes plugin get_short_description() values, including link names, URLs, and text snippets, rather than only the page shape. This issue is fixed in versions 5.0.8.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 19:46 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/django-cms/django-cms/security… | x_refsource_CONFIRM |
| https://github.com/django-cms/django-cms/pull/8645 | x_refsource_MISC |
| https://github.com/django-cms/django-cms/commit/7… | x_refsource_MISC |
| https://github.com/django-cms/django-cms/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| django-cms | django-cms |
Affected:
< 5.0.8
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54624",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T19:46:01.059187Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T19:46:10.950Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "django-cms",
"vendor": "django-cms",
"versions": [
{
"status": "affected",
"version": "\u003c 5.0.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, render_object_structure in cms/views.py renders cms/toolbar/structure.html for a PageContent object without calling user_can_view_page(). Any staff account can request a restricted page\u2019s structure when CMS_PERMISSION is enabled and the page has view restrictions or CMS_PUBLIC_FOR is set to staff. The response exposes plugin get_short_description() values, including link names, URLs, and text snippets, rather than only the page shape. This issue is fixed in versions 5.0.8."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285: Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T18:04:38.766Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/django-cms/django-cms/security/advisories/GHSA-vgxm-h9gx-h9w7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/django-cms/django-cms/security/advisories/GHSA-vgxm-h9gx-h9w7"
},
{
"name": "https://github.com/django-cms/django-cms/pull/8645",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/django-cms/django-cms/pull/8645"
},
{
"name": "https://github.com/django-cms/django-cms/commit/7642a98ab3170793c0b27b4125dd1f3d318b8a1c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/django-cms/django-cms/commit/7642a98ab3170793c0b27b4125dd1f3d318b8a1c"
},
{
"name": "https://github.com/django-cms/django-cms/releases/tag/5.0.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/django-cms/django-cms/releases/tag/5.0.8"
}
],
"source": {
"advisory": "GHSA-vgxm-h9gx-h9w7",
"discovery": "UNKNOWN"
},
"title": "django CMS: Structure endpoint bypasses page-view permission"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54624",
"datePublished": "2026-08-20T18:04:38.766Z",
"dateReserved": "2026-06-15T20:07:02.185Z",
"dateUpdated": "2026-08-20T19:46:10.950Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54622 (GCVE-0-2026-54622)
Vulnerability from nvd – Published: 2026-08-20 18:06 – Updated: 2026-08-20 18:50
VLAI
EPSS
VEX
Title
django CMS: Clipboard copy IDOR discloses unauthorized plugin content
Summary
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the copy_plugins endpoint in cms/admin/placeholderadmin.py authorizes only the destination clipboard. The _copy_plugin_to_clipboard and _copy_placeholder_to_clipboard paths accept source_placeholder_id and source_plugin_id values but use has_copy_plugins_permission and check_source only for the requesting user’s clipboard, without validating the source placeholder. Under CMS_PERMISSION, a staff user with the global add permission for a plugin type can copy plugins from an unauthorized page or placeholder into the user’s clipboard and read secret text, link names, and URLs. This issue is fixed in versions 5.0.8.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 18:49 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/django-cms/django-cms/security… | x_refsource_CONFIRM |
| https://github.com/django-cms/django-cms/pull/8645 | x_refsource_MISC |
| https://github.com/django-cms/django-cms/commit/7… | x_refsource_MISC |
| https://github.com/django-cms/django-cms/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| django-cms | django-cms |
Affected:
< 5.0.8
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54622",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T18:49:51.362110Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T18:50:59.089Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "django-cms",
"vendor": "django-cms",
"versions": [
{
"status": "affected",
"version": "\u003c 5.0.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the copy_plugins endpoint in cms/admin/placeholderadmin.py authorizes only the destination clipboard. The _copy_plugin_to_clipboard and _copy_placeholder_to_clipboard paths accept source_placeholder_id and source_plugin_id values but use has_copy_plugins_permission and check_source only for the requesting user\u2019s clipboard, without validating the source placeholder. Under CMS_PERMISSION, a staff user with the global add permission for a plugin type can copy plugins from an unauthorized page or placeholder into the user\u2019s clipboard and read secret text, link names, and URLs. This issue is fixed in versions 5.0.8."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T18:06:00.186Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/django-cms/django-cms/security/advisories/GHSA-4xfr-4p46-gc6p",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/django-cms/django-cms/security/advisories/GHSA-4xfr-4p46-gc6p"
},
{
"name": "https://github.com/django-cms/django-cms/pull/8645",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/django-cms/django-cms/pull/8645"
},
{
"name": "https://github.com/django-cms/django-cms/commit/7642a98ab3170793c0b27b4125dd1f3d318b8a1c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/django-cms/django-cms/commit/7642a98ab3170793c0b27b4125dd1f3d318b8a1c"
},
{
"name": "https://github.com/django-cms/django-cms/releases/tag/5.0.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/django-cms/django-cms/releases/tag/5.0.8"
}
],
"source": {
"advisory": "GHSA-4xfr-4p46-gc6p",
"discovery": "UNKNOWN"
},
"title": "django CMS: Clipboard copy IDOR discloses unauthorized plugin content"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54622",
"datePublished": "2026-08-20T18:06:00.186Z",
"dateReserved": "2026-06-15T20:07:02.184Z",
"dateUpdated": "2026-08-20T18:50:59.089Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54625 (GCVE-0-2026-54625)
Vulnerability from nvd – Published: 2026-08-20 17:58 – Updated: 2026-08-20 19:45
VLAI
EPSS
VEX
Title
django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)
Summary
django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request headers declared by plugins through get_vary_cache_on(). The _page_cache_key function includes the cache prefix, site, language, path, and timezone but not the declared header values. Although set_page_cache adds those names to the response Vary header, get_page_cache retrieves the first stored variant under the same header-agnostic key. When CMS_PAGE_CACHE is enabled and a plugin varies content on a header such as Country-Code, one visitor can receive another visitor’s request-specific content, and an unauthenticated attacker can prime the cache with attacker-chosen content. This issue is fixed in versions 5.0.8 and 5.1.0.
Severity
4.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 19:45 UTC
CWE
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/django-cms/django-cms/security… | x_refsource_CONFIRM |
| https://github.com/django-cms/django-cms/pull/8646 | x_refsource_MISC |
| https://github.com/django-cms/django-cms/pull/8647 | x_refsource_MISC |
| https://github.com/django-cms/django-cms/commit/8… | x_refsource_MISC |
| https://github.com/django-cms/django-cms/commit/d… | x_refsource_MISC |
| https://github.com/django-cms/django-cms/releases… | x_refsource_MISC |
| https://github.com/django-cms/django-cms/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| django-cms | django-cms |
Affected:
< 5.0.8
Affected: >= 5.1.0a1, < 5.1.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54625",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T19:45:03.782972Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T19:45:17.403Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "django-cms",
"vendor": "django-cms",
"versions": [
{
"status": "affected",
"version": "\u003c 5.0.8"
},
{
"status": "affected",
"version": "\u003e= 5.1.0a1, \u003c 5.1.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request headers declared by plugins through get_vary_cache_on(). The _page_cache_key function includes the cache prefix, site, language, path, and timezone but not the declared header values. Although set_page_cache adds those names to the response Vary header, get_page_cache retrieves the first stored variant under the same header-agnostic key. When CMS_PAGE_CACHE is enabled and a plugin varies content on a header such as Country-Code, one visitor can receive another visitor\u2019s request-specific content, and an unauthenticated attacker can prime the cache with attacker-chosen content. This issue is fixed in versions 5.0.8 and 5.1.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-349",
"description": "CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-524",
"description": "CWE-524: Use of Cache Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T17:58:45.182Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/django-cms/django-cms/security/advisories/GHSA-fwjf-m4qw-9f2x",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/django-cms/django-cms/security/advisories/GHSA-fwjf-m4qw-9f2x"
},
{
"name": "https://github.com/django-cms/django-cms/pull/8646",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/django-cms/django-cms/pull/8646"
},
{
"name": "https://github.com/django-cms/django-cms/pull/8647",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/django-cms/django-cms/pull/8647"
},
{
"name": "https://github.com/django-cms/django-cms/commit/8758714b865ffa79c6bcd0e5c503958ea48885aa",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/django-cms/django-cms/commit/8758714b865ffa79c6bcd0e5c503958ea48885aa"
},
{
"name": "https://github.com/django-cms/django-cms/commit/d5dc1efa18d157445491c4b12c2dd1efd56f439f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/django-cms/django-cms/commit/d5dc1efa18d157445491c4b12c2dd1efd56f439f"
},
{
"name": "https://github.com/django-cms/django-cms/releases/tag/5.0.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/django-cms/django-cms/releases/tag/5.0.8"
},
{
"name": "https://github.com/django-cms/django-cms/releases/tag/5.1.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/django-cms/django-cms/releases/tag/5.1.0"
}
],
"source": {
"advisory": "GHSA-fwjf-m4qw-9f2x",
"discovery": "UNKNOWN"
},
"title": "django CMS: Page cache ignores plugin-declared Vary headers (disclosure \u0026 poisoning)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54625",
"datePublished": "2026-08-20T17:58:03.255Z",
"dateReserved": "2026-06-15T20:07:02.185Z",
"dateUpdated": "2026-08-20T19:45:17.403Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54623 (GCVE-0-2026-54623)
Vulnerability from nvd – Published: 2026-08-20 18:02 – Updated: 2026-08-20 18:47
VLAI
EPSS
VEX
Title
django CMS: Plugin move endpoint allows cyclic reparenting (DoS)
Summary
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the move_plugin endpoint in cms/admin/placeholderadmin.py accepts an attacker-controlled plugin_parent value without rejecting a plugin’s own identifier or a descendant identifier. A staff user with plugin-change permission under CMS_PERMISSION can create a parent_id cycle in the plugin tree. The _get_descendants_cte and _get_ancestors_cte queries in cms/models/pluginmodel.py have no cycle guard, so get_descendants() and later rendering, copy, or delete operations can recurse indefinitely or reach a database recursion limit, corrupting the tree and consuming request workers. This issue is fixed in versions 5.0.8.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 18:44 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/django-cms/django-cms/security… | x_refsource_CONFIRM |
| https://github.com/django-cms/django-cms/pull/8645 | x_refsource_MISC |
| https://github.com/django-cms/django-cms/commit/7… | x_refsource_MISC |
| https://github.com/django-cms/django-cms/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| django-cms | django-cms |
Affected:
< 5.0.8
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54623",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T18:44:44.366071Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T18:47:19.789Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "django-cms",
"vendor": "django-cms",
"versions": [
{
"status": "affected",
"version": "\u003c 5.0.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the move_plugin endpoint in cms/admin/placeholderadmin.py accepts an attacker-controlled plugin_parent value without rejecting a plugin\u2019s own identifier or a descendant identifier. A staff user with plugin-change permission under CMS_PERMISSION can create a parent_id cycle in the plugin tree. The _get_descendants_cte and _get_ancestors_cte queries in cms/models/pluginmodel.py have no cycle guard, so get_descendants() and later rendering, copy, or delete operations can recurse indefinitely or reach a database recursion limit, corrupting the tree and consuming request workers. This issue is fixed in versions 5.0.8."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "CWE-674: Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-835",
"description": "CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T18:02:45.599Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/django-cms/django-cms/security/advisories/GHSA-8jj7-4v57-frf5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/django-cms/django-cms/security/advisories/GHSA-8jj7-4v57-frf5"
},
{
"name": "https://github.com/django-cms/django-cms/pull/8645",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/django-cms/django-cms/pull/8645"
},
{
"name": "https://github.com/django-cms/django-cms/commit/7642a98ab3170793c0b27b4125dd1f3d318b8a1c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/django-cms/django-cms/commit/7642a98ab3170793c0b27b4125dd1f3d318b8a1c"
},
{
"name": "https://github.com/django-cms/django-cms/releases/tag/5.0.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/django-cms/django-cms/releases/tag/5.0.8"
}
],
"source": {
"advisory": "GHSA-8jj7-4v57-frf5",
"discovery": "UNKNOWN"
},
"title": "django CMS: Plugin move endpoint allows cyclic reparenting (DoS)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54623",
"datePublished": "2026-08-20T18:02:45.599Z",
"dateReserved": "2026-06-15T20:07:02.184Z",
"dateUpdated": "2026-08-20T18:47:19.789Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-75526 (GCVE-0-2026-75526)
Vulnerability from cvelistv5 – Published: 2026-08-20 18:11 – Updated: 2026-08-20 19:20
VLAI
EPSS
VEX
Title
django CMS: Stored XSS in edit-mode plugin exception rendering
Summary
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. From 5.0.8 until 5.0.9, ContentRenderer.render_placeholder in cms/plugin_rendering.py can pass stored, attacker-controlled values to ContentRenderer.render_exception when plugin rendering fails in edit mode. Values from get_short_description(), the exception message, the placeholder, or placeholder.source are interpolated into a cms-rendering-exception heading and later returned through mark_safe. Because the heading is not escaped, stored HTML executes in an editor’s browser, and settings.DEBUG does not prevent the custom heading from rendering. The fix uses format_html to escape the message before safe placeholder output is returned. This issue is fixed in versions 5.0.9.
Severity
4.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 19:20 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/django-cms/django-cms/security… | x_refsource_CONFIRM |
| https://github.com/django-cms/django-cms/pull/8711 | x_refsource_MISC |
| https://github.com/django-cms/django-cms/commit/b… | x_refsource_MISC |
| https://github.com/django-cms/django-cms/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| django-cms | django-cms |
Affected:
>= 5.0.8, < 5.0.9
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-75526",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T19:20:47.120348Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T19:20:52.755Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "django-cms",
"vendor": "django-cms",
"versions": [
{
"status": "affected",
"version": "\u003e= 5.0.8, \u003c 5.0.9"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. From 5.0.8 until 5.0.9, ContentRenderer.render_placeholder in cms/plugin_rendering.py can pass stored, attacker-controlled values to ContentRenderer.render_exception when plugin rendering fails in edit mode. Values from get_short_description(), the exception message, the placeholder, or placeholder.source are interpolated into a cms-rendering-exception heading and later returned through mark_safe. Because the heading is not escaped, stored HTML executes in an editor\u2019s browser, and settings.DEBUG does not prevent the custom heading from rendering. The fix uses format_html to escape the message before safe placeholder output is returned. This issue is fixed in versions 5.0.9."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T18:11:10.220Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/django-cms/django-cms/security/advisories/GHSA-hvq6-2r72-p2x7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/django-cms/django-cms/security/advisories/GHSA-hvq6-2r72-p2x7"
},
{
"name": "https://github.com/django-cms/django-cms/pull/8711",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/django-cms/django-cms/pull/8711"
},
{
"name": "https://github.com/django-cms/django-cms/commit/b56a568844ff3702495945f73a31d0868285bf88",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/django-cms/django-cms/commit/b56a568844ff3702495945f73a31d0868285bf88"
},
{
"name": "https://github.com/django-cms/django-cms/releases/tag/5.0.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/django-cms/django-cms/releases/tag/5.0.9"
}
],
"source": {
"advisory": "GHSA-hvq6-2r72-p2x7",
"discovery": "UNKNOWN"
},
"title": "django CMS: Stored XSS in edit-mode plugin exception rendering"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-75526",
"datePublished": "2026-08-20T18:11:10.220Z",
"dateReserved": "2026-08-17T20:49:21.600Z",
"dateUpdated": "2026-08-20T19:20:52.755Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63003 (GCVE-0-2026-63003)
Vulnerability from cvelistv5 – Published: 2026-08-20 18:09 – Updated: 2026-08-21 21:46
VLAI
EPSS
VEX
Title
django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)
Summary
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, page duplication lacks an object-level authorization check on the source page. In cms/admin/forms.py, DuplicatePageForm.source accepts any Page, the AddPageForm constructor does not narrow a hidden source field, AddPageForm.clean does not validate the source against the user, and AddPageForm.save calls from_source. In cms/admin/pageadmin.py, duplicate and PageAdmin.has_add_permission check only whether a staff user may add a page. A crafted source value can therefore copy every placeholder and plugin from an unauthorized page with permissions=False, stripping source view restrictions and exposing content across sites or restricted subtrees when CMS_PERMISSION is enabled. This issue is fixed in versions 5.0.9.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 20:58 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/django-cms/django-cms/security… | x_refsource_CONFIRM |
| https://github.com/django-cms/django-cms/pull/8713 | x_refsource_MISC |
| https://github.com/django-cms/django-cms/commit/3… | x_refsource_MISC |
| https://github.com/django-cms/django-cms/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| django-cms | django-cms |
Affected:
< 5.0.9
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63003",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T20:58:41.902595Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T21:46:19.864Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "django-cms",
"vendor": "django-cms",
"versions": [
{
"status": "affected",
"version": "\u003c 5.0.9"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, page duplication lacks an object-level authorization check on the source page. In cms/admin/forms.py, DuplicatePageForm.source accepts any Page, the AddPageForm constructor does not narrow a hidden source field, AddPageForm.clean does not validate the source against the user, and AddPageForm.save calls from_source. In cms/admin/pageadmin.py, duplicate and PageAdmin.has_add_permission check only whether a staff user may add a page. A crafted source value can therefore copy every placeholder and plugin from an unauthorized page with permissions=False, stripping source view restrictions and exposing content across sites or restricted subtrees when CMS_PERMISSION is enabled. This issue is fixed in versions 5.0.9."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T18:09:13.988Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/django-cms/django-cms/security/advisories/GHSA-6x92-6vx4-5fwr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/django-cms/django-cms/security/advisories/GHSA-6x92-6vx4-5fwr"
},
{
"name": "https://github.com/django-cms/django-cms/pull/8713",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/django-cms/django-cms/pull/8713"
},
{
"name": "https://github.com/django-cms/django-cms/commit/3e1ccf7573eb1a74ebbbfaaa812c1f5cadf14e6c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/django-cms/django-cms/commit/3e1ccf7573eb1a74ebbbfaaa812c1f5cadf14e6c"
},
{
"name": "https://github.com/django-cms/django-cms/releases/tag/5.0.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/django-cms/django-cms/releases/tag/5.0.9"
}
],
"source": {
"advisory": "GHSA-6x92-6vx4-5fwr",
"discovery": "UNKNOWN"
},
"title": "django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-63003",
"datePublished": "2026-08-20T18:09:13.988Z",
"dateReserved": "2026-07-14T23:10:57.032Z",
"dateUpdated": "2026-08-21T21:46:19.864Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-61663 (GCVE-0-2026-61663)
Vulnerability from cvelistv5 – Published: 2026-08-20 18:07 – Updated: 2026-08-20 18:07
VLAI
EPSS
VEX
Title
django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff
Summary
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, render_object_structure fails to authorize non-PageContent objects that use PlaceholderRelationField. An active staff user without cms.use_structure or model-level view or change permission can request the //admin/cms/placeholder/object/<content_type_id>/structure/<object_id>/ endpoint with guessed content_type_id and object_id values. The response discloses placeholder slot names, plugin trees, plugin identifiers, labels, and object existence for frontend-editable objects. The fix applies user_can_view_placeholder_source to the non-PageContent branch while keeping the structure board read-only for view-only users. This issue is fixed in versions 5.0.9.
Severity
4.3 (Medium)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/django-cms/django-cms/security… | x_refsource_CONFIRM |
| https://github.com/django-cms/django-cms/pull/8703 | x_refsource_MISC |
| https://github.com/django-cms/django-cms/commit/9… | x_refsource_MISC |
| https://github.com/django-cms/django-cms/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| django-cms | django-cms |
Affected:
< 5.0.9
|
{
"containers": {
"cna": {
"affected": [
{
"product": "django-cms",
"vendor": "django-cms",
"versions": [
{
"status": "affected",
"version": "\u003c 5.0.9"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, render_object_structure fails to authorize non-PageContent objects that use PlaceholderRelationField. An active staff user without cms.use_structure or model-level view or change permission can request the //admin/cms/placeholder/object/\u003ccontent_type_id\u003e/structure/\u003cobject_id\u003e/ endpoint with guessed content_type_id and object_id values. The response discloses placeholder slot names, plugin trees, plugin identifiers, labels, and object existence for frontend-editable objects. The fix applies user_can_view_placeholder_source to the non-PageContent branch while keeping the structure board read-only for view-only users. This issue is fixed in versions 5.0.9."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T18:07:28.005Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/django-cms/django-cms/security/advisories/GHSA-8qj2-c6q4-f399",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/django-cms/django-cms/security/advisories/GHSA-8qj2-c6q4-f399"
},
{
"name": "https://github.com/django-cms/django-cms/pull/8703",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/django-cms/django-cms/pull/8703"
},
{
"name": "https://github.com/django-cms/django-cms/commit/9c82abfeb25471583e23906ea1ebef9202527b04",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/django-cms/django-cms/commit/9c82abfeb25471583e23906ea1ebef9202527b04"
},
{
"name": "https://github.com/django-cms/django-cms/releases/tag/5.0.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/django-cms/django-cms/releases/tag/5.0.9"
}
],
"source": {
"advisory": "GHSA-8qj2-c6q4-f399",
"discovery": "UNKNOWN"
},
"title": "django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-61663",
"datePublished": "2026-08-20T18:07:28.005Z",
"dateReserved": "2026-07-10T18:25:21.467Z",
"dateUpdated": "2026-08-20T18:07:28.005Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54622 (GCVE-0-2026-54622)
Vulnerability from cvelistv5 – Published: 2026-08-20 18:06 – Updated: 2026-08-20 18:50
VLAI
EPSS
VEX
Title
django CMS: Clipboard copy IDOR discloses unauthorized plugin content
Summary
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the copy_plugins endpoint in cms/admin/placeholderadmin.py authorizes only the destination clipboard. The _copy_plugin_to_clipboard and _copy_placeholder_to_clipboard paths accept source_placeholder_id and source_plugin_id values but use has_copy_plugins_permission and check_source only for the requesting user’s clipboard, without validating the source placeholder. Under CMS_PERMISSION, a staff user with the global add permission for a plugin type can copy plugins from an unauthorized page or placeholder into the user’s clipboard and read secret text, link names, and URLs. This issue is fixed in versions 5.0.8.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 18:49 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/django-cms/django-cms/security… | x_refsource_CONFIRM |
| https://github.com/django-cms/django-cms/pull/8645 | x_refsource_MISC |
| https://github.com/django-cms/django-cms/commit/7… | x_refsource_MISC |
| https://github.com/django-cms/django-cms/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| django-cms | django-cms |
Affected:
< 5.0.8
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54622",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T18:49:51.362110Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T18:50:59.089Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "django-cms",
"vendor": "django-cms",
"versions": [
{
"status": "affected",
"version": "\u003c 5.0.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the copy_plugins endpoint in cms/admin/placeholderadmin.py authorizes only the destination clipboard. The _copy_plugin_to_clipboard and _copy_placeholder_to_clipboard paths accept source_placeholder_id and source_plugin_id values but use has_copy_plugins_permission and check_source only for the requesting user\u2019s clipboard, without validating the source placeholder. Under CMS_PERMISSION, a staff user with the global add permission for a plugin type can copy plugins from an unauthorized page or placeholder into the user\u2019s clipboard and read secret text, link names, and URLs. This issue is fixed in versions 5.0.8."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T18:06:00.186Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/django-cms/django-cms/security/advisories/GHSA-4xfr-4p46-gc6p",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/django-cms/django-cms/security/advisories/GHSA-4xfr-4p46-gc6p"
},
{
"name": "https://github.com/django-cms/django-cms/pull/8645",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/django-cms/django-cms/pull/8645"
},
{
"name": "https://github.com/django-cms/django-cms/commit/7642a98ab3170793c0b27b4125dd1f3d318b8a1c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/django-cms/django-cms/commit/7642a98ab3170793c0b27b4125dd1f3d318b8a1c"
},
{
"name": "https://github.com/django-cms/django-cms/releases/tag/5.0.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/django-cms/django-cms/releases/tag/5.0.8"
}
],
"source": {
"advisory": "GHSA-4xfr-4p46-gc6p",
"discovery": "UNKNOWN"
},
"title": "django CMS: Clipboard copy IDOR discloses unauthorized plugin content"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54622",
"datePublished": "2026-08-20T18:06:00.186Z",
"dateReserved": "2026-06-15T20:07:02.184Z",
"dateUpdated": "2026-08-20T18:50:59.089Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54624 (GCVE-0-2026-54624)
Vulnerability from cvelistv5 – Published: 2026-08-20 18:04 – Updated: 2026-08-20 19:46
VLAI
EPSS
VEX
Title
django CMS: Structure endpoint bypasses page-view permission
Summary
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, render_object_structure in cms/views.py renders cms/toolbar/structure.html for a PageContent object without calling user_can_view_page(). Any staff account can request a restricted page’s structure when CMS_PERMISSION is enabled and the page has view restrictions or CMS_PUBLIC_FOR is set to staff. The response exposes plugin get_short_description() values, including link names, URLs, and text snippets, rather than only the page shape. This issue is fixed in versions 5.0.8.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 19:46 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/django-cms/django-cms/security… | x_refsource_CONFIRM |
| https://github.com/django-cms/django-cms/pull/8645 | x_refsource_MISC |
| https://github.com/django-cms/django-cms/commit/7… | x_refsource_MISC |
| https://github.com/django-cms/django-cms/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| django-cms | django-cms |
Affected:
< 5.0.8
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54624",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T19:46:01.059187Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T19:46:10.950Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "django-cms",
"vendor": "django-cms",
"versions": [
{
"status": "affected",
"version": "\u003c 5.0.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, render_object_structure in cms/views.py renders cms/toolbar/structure.html for a PageContent object without calling user_can_view_page(). Any staff account can request a restricted page\u2019s structure when CMS_PERMISSION is enabled and the page has view restrictions or CMS_PUBLIC_FOR is set to staff. The response exposes plugin get_short_description() values, including link names, URLs, and text snippets, rather than only the page shape. This issue is fixed in versions 5.0.8."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285: Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T18:04:38.766Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/django-cms/django-cms/security/advisories/GHSA-vgxm-h9gx-h9w7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/django-cms/django-cms/security/advisories/GHSA-vgxm-h9gx-h9w7"
},
{
"name": "https://github.com/django-cms/django-cms/pull/8645",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/django-cms/django-cms/pull/8645"
},
{
"name": "https://github.com/django-cms/django-cms/commit/7642a98ab3170793c0b27b4125dd1f3d318b8a1c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/django-cms/django-cms/commit/7642a98ab3170793c0b27b4125dd1f3d318b8a1c"
},
{
"name": "https://github.com/django-cms/django-cms/releases/tag/5.0.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/django-cms/django-cms/releases/tag/5.0.8"
}
],
"source": {
"advisory": "GHSA-vgxm-h9gx-h9w7",
"discovery": "UNKNOWN"
},
"title": "django CMS: Structure endpoint bypasses page-view permission"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54624",
"datePublished": "2026-08-20T18:04:38.766Z",
"dateReserved": "2026-06-15T20:07:02.185Z",
"dateUpdated": "2026-08-20T19:46:10.950Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54623 (GCVE-0-2026-54623)
Vulnerability from cvelistv5 – Published: 2026-08-20 18:02 – Updated: 2026-08-20 18:47
VLAI
EPSS
VEX
Title
django CMS: Plugin move endpoint allows cyclic reparenting (DoS)
Summary
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the move_plugin endpoint in cms/admin/placeholderadmin.py accepts an attacker-controlled plugin_parent value without rejecting a plugin’s own identifier or a descendant identifier. A staff user with plugin-change permission under CMS_PERMISSION can create a parent_id cycle in the plugin tree. The _get_descendants_cte and _get_ancestors_cte queries in cms/models/pluginmodel.py have no cycle guard, so get_descendants() and later rendering, copy, or delete operations can recurse indefinitely or reach a database recursion limit, corrupting the tree and consuming request workers. This issue is fixed in versions 5.0.8.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 18:44 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/django-cms/django-cms/security… | x_refsource_CONFIRM |
| https://github.com/django-cms/django-cms/pull/8645 | x_refsource_MISC |
| https://github.com/django-cms/django-cms/commit/7… | x_refsource_MISC |
| https://github.com/django-cms/django-cms/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| django-cms | django-cms |
Affected:
< 5.0.8
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54623",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T18:44:44.366071Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T18:47:19.789Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "django-cms",
"vendor": "django-cms",
"versions": [
{
"status": "affected",
"version": "\u003c 5.0.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the move_plugin endpoint in cms/admin/placeholderadmin.py accepts an attacker-controlled plugin_parent value without rejecting a plugin\u2019s own identifier or a descendant identifier. A staff user with plugin-change permission under CMS_PERMISSION can create a parent_id cycle in the plugin tree. The _get_descendants_cte and _get_ancestors_cte queries in cms/models/pluginmodel.py have no cycle guard, so get_descendants() and later rendering, copy, or delete operations can recurse indefinitely or reach a database recursion limit, corrupting the tree and consuming request workers. This issue is fixed in versions 5.0.8."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "CWE-674: Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-835",
"description": "CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T18:02:45.599Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/django-cms/django-cms/security/advisories/GHSA-8jj7-4v57-frf5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/django-cms/django-cms/security/advisories/GHSA-8jj7-4v57-frf5"
},
{
"name": "https://github.com/django-cms/django-cms/pull/8645",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/django-cms/django-cms/pull/8645"
},
{
"name": "https://github.com/django-cms/django-cms/commit/7642a98ab3170793c0b27b4125dd1f3d318b8a1c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/django-cms/django-cms/commit/7642a98ab3170793c0b27b4125dd1f3d318b8a1c"
},
{
"name": "https://github.com/django-cms/django-cms/releases/tag/5.0.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/django-cms/django-cms/releases/tag/5.0.8"
}
],
"source": {
"advisory": "GHSA-8jj7-4v57-frf5",
"discovery": "UNKNOWN"
},
"title": "django CMS: Plugin move endpoint allows cyclic reparenting (DoS)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54623",
"datePublished": "2026-08-20T18:02:45.599Z",
"dateReserved": "2026-06-15T20:07:02.184Z",
"dateUpdated": "2026-08-20T18:47:19.789Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54625 (GCVE-0-2026-54625)
Vulnerability from cvelistv5 – Published: 2026-08-20 17:58 – Updated: 2026-08-20 19:45
VLAI
EPSS
VEX
Title
django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)
Summary
django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request headers declared by plugins through get_vary_cache_on(). The _page_cache_key function includes the cache prefix, site, language, path, and timezone but not the declared header values. Although set_page_cache adds those names to the response Vary header, get_page_cache retrieves the first stored variant under the same header-agnostic key. When CMS_PAGE_CACHE is enabled and a plugin varies content on a header such as Country-Code, one visitor can receive another visitor’s request-specific content, and an unauthenticated attacker can prime the cache with attacker-chosen content. This issue is fixed in versions 5.0.8 and 5.1.0.
Severity
4.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 19:45 UTC
CWE
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/django-cms/django-cms/security… | x_refsource_CONFIRM |
| https://github.com/django-cms/django-cms/pull/8646 | x_refsource_MISC |
| https://github.com/django-cms/django-cms/pull/8647 | x_refsource_MISC |
| https://github.com/django-cms/django-cms/commit/8… | x_refsource_MISC |
| https://github.com/django-cms/django-cms/commit/d… | x_refsource_MISC |
| https://github.com/django-cms/django-cms/releases… | x_refsource_MISC |
| https://github.com/django-cms/django-cms/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| django-cms | django-cms |
Affected:
< 5.0.8
Affected: >= 5.1.0a1, < 5.1.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54625",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T19:45:03.782972Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T19:45:17.403Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "django-cms",
"vendor": "django-cms",
"versions": [
{
"status": "affected",
"version": "\u003c 5.0.8"
},
{
"status": "affected",
"version": "\u003e= 5.1.0a1, \u003c 5.1.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request headers declared by plugins through get_vary_cache_on(). The _page_cache_key function includes the cache prefix, site, language, path, and timezone but not the declared header values. Although set_page_cache adds those names to the response Vary header, get_page_cache retrieves the first stored variant under the same header-agnostic key. When CMS_PAGE_CACHE is enabled and a plugin varies content on a header such as Country-Code, one visitor can receive another visitor\u2019s request-specific content, and an unauthenticated attacker can prime the cache with attacker-chosen content. This issue is fixed in versions 5.0.8 and 5.1.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-349",
"description": "CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-524",
"description": "CWE-524: Use of Cache Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T17:58:45.182Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/django-cms/django-cms/security/advisories/GHSA-fwjf-m4qw-9f2x",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/django-cms/django-cms/security/advisories/GHSA-fwjf-m4qw-9f2x"
},
{
"name": "https://github.com/django-cms/django-cms/pull/8646",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/django-cms/django-cms/pull/8646"
},
{
"name": "https://github.com/django-cms/django-cms/pull/8647",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/django-cms/django-cms/pull/8647"
},
{
"name": "https://github.com/django-cms/django-cms/commit/8758714b865ffa79c6bcd0e5c503958ea48885aa",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/django-cms/django-cms/commit/8758714b865ffa79c6bcd0e5c503958ea48885aa"
},
{
"name": "https://github.com/django-cms/django-cms/commit/d5dc1efa18d157445491c4b12c2dd1efd56f439f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/django-cms/django-cms/commit/d5dc1efa18d157445491c4b12c2dd1efd56f439f"
},
{
"name": "https://github.com/django-cms/django-cms/releases/tag/5.0.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/django-cms/django-cms/releases/tag/5.0.8"
},
{
"name": "https://github.com/django-cms/django-cms/releases/tag/5.1.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/django-cms/django-cms/releases/tag/5.1.0"
}
],
"source": {
"advisory": "GHSA-fwjf-m4qw-9f2x",
"discovery": "UNKNOWN"
},
"title": "django CMS: Page cache ignores plugin-declared Vary headers (disclosure \u0026 poisoning)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54625",
"datePublished": "2026-08-20T17:58:03.255Z",
"dateReserved": "2026-06-15T20:07:02.185Z",
"dateUpdated": "2026-08-20T19:45:17.403Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}