django-page-cms through 2.0.13 Unauthorized Content Access via Staff Account
Priority LOW 32CWE-862Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
django-page-cms through 2.0.13 fails to properly validate page permissions in admin helper views, allowing any staff account to read arbitrary page content and stored media paths. Attackers with low-privilege staff credentials can enumerate content identifiers and access unpublished drafts, page listings, and file paths without proper authorization checks.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00454 39th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-93455
- 2026-10-03 Alias added: GHSA-v2qc-hf9w-393g
References
Other 5
- GitHub Issue #244
- https://github.com/batiste/django-page-cms
- get_content() resolves Content by content_id alone, ignoring page_id, behind @staff_member_required only
- get_media_url() returns any stored media path by media_id behind @staff_member_required only
- list_pages_ajax() renders the full page listing behind @staff_member_required with no has_perm('pages.change_page') gate, as do get_last_content (L121), traduction (L156) and sub_menu (L210)
More batiste vulnerabilities
- TI-2026-62984 django-page-cms through 2.0.13 CSRF via admin mutation views CVSS 4.0HIGH 8.4
Sources
- CVE-2026-93455 · CVE Program
- CVE-2026-93455 · NVD
- FIRST EPSS
- GHSA-v2qc-hf9w-393g · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences