Read the docs
TI-2026-45004 Aliases CVE-2026-63003GHSA-6x92-6vx4-5fwr

Authorization bypass in django-cms

Priority LOW 29CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-639.

Summary

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, page duplication lacks an object-level authorization check on the source page. In cms/admin/forms.py, DuplicatePageForm.source accepts any Page, the AddPageForm constructor does not narrow a hidden source field, AddPageForm.clean does not validate the source against the user, and AddPageForm.save calls from_source. In cms/admin/pageadmin.py, duplicate and PageAdmin.has_add_permission check only whether a staff user may add a page. A crafted source value can therefore copy every placeholder and plugin from an unauthorized page with permissions=False, stripping source view restrictions and exposing content across sites or restricted subtrees when CMS_PERMISSION is enabled. This issue is fixed in versions 5.0.9.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00415 36th percentileScored 2026-11-07
Fix Fixed django-cms (django-cms): 5.0.9django-cms (PyPI): 5.0.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
django-cmsdjango-cmsbefore 5.0.95.0.9Patch availableCNA
—django-cms (PyPI)before 5.0.95.0.9Patch availableGHSA-6x92-6vx4-5fwr
  • django-cms Vendordjango-cms Affected before 5.0.9 Fixed in 5.0.9 Patch available CNA
  • django-cms (PyPI) Vendor— Affected before 5.0.9 Fixed in 5.0.9 Patch available GHSA-6x92-6vx4-5fwr

Remediation

  • Fix · CNA django-cms (django-cms) Fixed in 5.0.9
  • Fix · GHSA-6x92-6vx4-5fwr django-cms (PyPI) Fixed in 5.0.9 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-63003
  2. 2026-10-03 Alias added: GHSA-6x92-6vx4-5fwr

References

Other 5

  • TI-2024-10485 Stored XSS in Open Source Project "django-cms" CVSS 3.1MEDIUM 4.8
  • TI-2026-44152 Authorization bypass in django-cms CVSS 3.1MEDIUM 4.3
  • TI-2015-04262 Cross-site request forgery (CSRF) vulnerability in django CMS before 3.0.14, 3.1.x before… CVSS 3.0HIGH 8.8
  • TI-2026-39454 django CMS: Plugin move endpoint allows cyclic reparenting (DoS) CVSS 3.1HIGH 7.1
  • TI-2026-39455 django CMS: Structure endpoint bypasses page-view permission CVSS 3.1MEDIUM 6.5
  • TI-2026-39453 django CMS: Clipboard copy IDOR discloses unauthorized plugin content CVSS 3.1MEDIUM 6.5
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences