Read the docs
TI-2026-44152 Aliases CVE-2026-61663GHSA-8qj2-c6q4-f399

Authorization bypass in django-cms

Priority MEDIUM 53CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-639.

Summary

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, render_object_structure fails to authorize non-PageContent objects that use PlaceholderRelationField. An active staff user without cms.use_structure or model-level view or change permission can request the //admin/cms/placeholder/object/<content_type_id>/structure/<object_id>/ endpoint with guessed content_type_id and object_id values. The response discloses placeholder slot names, plugin trees, plugin identifiers, labels, and object existence for frontend-editable objects. The fix applies user_can_view_placeholder_source to the non-PageContent branch while keeping the structure board read-only for view-only users. This issue is fixed in versions 5.0.9.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00342 27th percentileScored 2026-11-07
Fix Fixed django-cms (django-cms): 5.0.9django-cms (PyPI): 5.0.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
django-cmsdjango-cmsbefore 5.0.95.0.9Patch availableCNA
—django-cms (PyPI)before 5.0.95.0.9Patch availableGHSA-8qj2-c6q4-f399
  • django-cms Vendordjango-cms Affected before 5.0.9 Fixed in 5.0.9 Patch available CNA
  • django-cms (PyPI) Vendor— Affected before 5.0.9 Fixed in 5.0.9 Patch available GHSA-8qj2-c6q4-f399

Remediation

  • Fix · CNA django-cms (django-cms) Fixed in 5.0.9
  • Fix · GHSA-8qj2-c6q4-f399 django-cms (PyPI) Fixed in 5.0.9 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-61663
  2. 2026-10-03 Alias added: GHSA-8qj2-c6q4-f399

References

Other 5

  • TI-2024-10485 Stored XSS in Open Source Project "django-cms" CVSS 3.1MEDIUM 4.8
  • TI-2015-04262 Cross-site request forgery (CSRF) vulnerability in django CMS before 3.0.14, 3.1.x before… CVSS 3.0HIGH 8.8
  • TI-2026-39454 django CMS: Plugin move endpoint allows cyclic reparenting (DoS) CVSS 3.1HIGH 7.1
  • TI-2026-45004 Authorization bypass in django-cms CVSS 3.1MEDIUM 6.5
  • TI-2026-39455 django CMS: Structure endpoint bypasses page-view permission CVSS 3.1MEDIUM 6.5
  • TI-2026-39453 django CMS: Clipboard copy IDOR discloses unauthorized plugin content CVSS 3.1MEDIUM 6.5
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences