Read the docs
TI-2026-39453 Aliases CVE-2026-54622GHSA-4xfr-4p46-gc6p

django CMS: Clipboard copy IDOR discloses unauthorized plugin content

Priority LOW 29CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-639.

Summary

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the copy_plugins endpoint in cms/admin/placeholderadmin.py authorizes only the destination clipboard. The _copy_plugin_to_clipboard and _copy_placeholder_to_clipboard paths accept source_placeholder_id and source_plugin_id values but use has_copy_plugins_permission and check_source only for the requesting user’s clipboard, without validating the source placeholder. Under CMS_PERMISSION, a staff user with the global add permission for a plugin type can copy plugins from an unauthorized page or placeholder into the user’s clipboard and read secret text, link names, and URLs. This issue is fixed in versions 5.0.8.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00415 36th percentileScored 2026-11-07
Fix Fixed django-cms (django-cms): 5.0.8django-cms (PyPI): 5.0.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
django-cmsdjango-cmsbefore 5.0.85.0.8Patch availableCNA
—django-cms (PyPI)before 5.0.85.0.8Patch availableGHSA-4xfr-4p46-gc6p
  • django-cms Vendordjango-cms Affected before 5.0.8 Fixed in 5.0.8 Patch available CNA
  • django-cms (PyPI) Vendor— Affected before 5.0.8 Fixed in 5.0.8 Patch available GHSA-4xfr-4p46-gc6p

Remediation

  • Fix · CNA django-cms (django-cms) Fixed in 5.0.8
  • Fix · GHSA-4xfr-4p46-gc6p django-cms (PyPI) Fixed in 5.0.8 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54622
  2. 2026-10-03 Alias added: GHSA-4xfr-4p46-gc6p

References

Other 5

  • TI-2024-10485 Stored XSS in Open Source Project "django-cms" CVSS 3.1MEDIUM 4.8
  • TI-2026-44152 Authorization bypass in django-cms CVSS 3.1MEDIUM 4.3
  • TI-2015-04262 Cross-site request forgery (CSRF) vulnerability in django CMS before 3.0.14, 3.1.x before… CVSS 3.0HIGH 8.8
  • TI-2026-39454 django CMS: Plugin move endpoint allows cyclic reparenting (DoS) CVSS 3.1HIGH 7.1
  • TI-2026-45004 Authorization bypass in django-cms CVSS 3.1MEDIUM 6.5
  • TI-2026-39455 django CMS: Structure endpoint bypasses page-view permission CVSS 3.1MEDIUM 6.5
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences