CVE-2026-54623: falha de alta gravidade em django-cms
django CMS: Plugin move endpoint allows cyclic reparenting (DoS)
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.1epss 0.5%
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the move_plugin endpoint in cms/admin/placeholderadmin.py accepts an attacker-controlled plugin_parent value without rejecting a plugin’s own identifier or a descendant identifier. A staff user with plugin-change permission under CMS_PERMISSION can create a parent_id cycle in the plugin tree. The _get_descendants_cte and _get_ancestors_cte queries in cms/models/pluginmodel.py have no cycle guard, so get_descendants() and later rendering, copy, or delete operations can recurse indefinitely or reach a database recursion limit, corrupting the tree and consuming request workers. This issue is fixed in versions 5.0.8.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Produtos afetados
django-cms · django-cmsCVEs relacionadas — django-cms
No mesmo produto, das mais perigosas para as menos.
CVE-2026-63003MEDIUMdjango CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)EPSS 0.4%CVE-2026-54622MEDIUMdjango CMS: Clipboard copy IDOR discloses unauthorized plugin contentEPSS 0.4%CVE-2026-54624MEDIUMdjango CMS: Structure endpoint bypasses page-view permissionEPSS 0.4%CVE-2026-61663MEDIUMdjango CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staffEPSS 0.3%CVE-2026-75526MEDIUMdjango CMS: Stored XSS in edit-mode plugin exception renderingEPSS 0.3%CVE-2026-54625MEDIUMdjango CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)EPSS 0.2%