CVE-2026-61663: falha de média gravidade em django-cms
django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.3epss 0.3%
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, render_object_structure fails to authorize non-PageContent objects that use PlaceholderRelationField. An active staff user without cms.use_structure or model-level view or change permission can request the //admin/cms/placeholder/object/<content_type_id>/structure/<object_id>/ endpoint with guessed content_type_id and object_id values. The response discloses placeholder slot names, plugin trees, plugin identifiers, labels, and object existence for frontend-editable objects. The fix applies user_can_view_placeholder_source to the non-PageContent branch while keeping the structure board read-only for view-only users. This issue is fixed in versions 5.0.9.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
django-cms · django-cmsCVEs relacionadas — django-cms
No mesmo produto, das mais perigosas para as menos.
CVE-2026-54623HIGHdjango CMS: Plugin move endpoint allows cyclic reparenting (DoS)EPSS 0.5%CVE-2026-63003MEDIUMdjango CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)EPSS 0.4%CVE-2026-54622MEDIUMdjango CMS: Clipboard copy IDOR discloses unauthorized plugin contentEPSS 0.4%CVE-2026-54624MEDIUMdjango CMS: Structure endpoint bypasses page-view permissionEPSS 0.4%CVE-2026-75526MEDIUMdjango CMS: Stored XSS in edit-mode plugin exception renderingEPSS 0.3%CVE-2026-54625MEDIUMdjango CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)EPSS 0.2%