https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-01T04:13:52.957826+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-54622 CVE-2026-54622 — django CMS: Clipboard copy IDOR discloses unauthorized plugin content 2026-10-01T04:13:53.130006+00:00

Affected: django-cms

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the copy_plugins endpoint in cms/admin/placeholderadmin.py authorizes only the destination clipboard. The _copy_plugin_to_clipboard and _copy_placeholder_to_clipboard paths accept source_placeholder_id and source_plugin_id values but use has_copy_plugins_permission and check_source only for the requesting user’s clipboard, without validating the source placeholder. Under CMS_PERMISSION, a staff user with the global add permission for a plugin type can copy plugins from an unauthorized page or placeholder into the user’s clipboard and read secret text, link names, and URLs. This issue is fixed in versions 5.0.8.

 https://vulnerability.circl.lu/vuln/ghsa-4xfr-4p46-gc6p GHSA-4xfr-4p46-gc6p — django CMS: Clipboard copy IDOR discloses unauthorized plugin content 2026-10-01T04:13:53.130114+00:00

Affected: PyPI: django-cms

### Summary The clipboard copy paths of the `copy_plugins` admin endpoint validate only the target (the user's own clipboard) and skip source-side authorization. A staff user can copy plugins out of a placeholder they have no permission on into their clipboard, then read the (secret) content.

### Details In `cms/admin/placeholderadmin.py`, `_copy_plugin_to_clipboard` and `_copy_placeholder_to_clipboard` check `has_copy_plugins_permission`, which only evaluates `request.toolbar.clipboard.has_add_plugins_permission(...)` — the clipboard belongs to the requesting user, and `check_source` is likewise applied only to the clipboard. The source placeholder identified by the attacker-supplied `source_placeholder_id` / `source_plugin_id` is never authorization-checked. (The placeholder-to-placeholder copy path, `has_copy_from_placeholder_permission`, correctly checks both sides.)

### Impact A staff user holding the global add permission for a plugin type, but with no access to a given placeholder/page, can copy that placeholder's plugins into their own clipboard and read content (e.g. link names/URLs, text) they cannot reach through the normal edit endpoints.

Requires `CMS_PERMISSION=True` with per-placeholder/page restrictions.

### Patches Fixed in 5.0.8: the clipboard copy paths now also verify source-side permission (`has_add_plugins_permission` + `check_source` on the source placeholder), matching placeholder-to-placeholder copy.

### Work…