https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 12:34:26 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-54624 <p>django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, render_object_structure in cms/views.py renders cms/toolbar/structure.html for a PageContent object without calling user_can_view_page(). Any staff account can request a restricted page’s structure when CMS_PERMISSION is enabled and the page has view restrictions or CMS_PUBLIC_FOR is set to staff. The response exposes plugin get_short_description() values, including link names, URLs, and text snippets, rather than only the page shape. This issue is fixed in versions 5.0.8.</p> <p>django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, render_object_structure in cms/views.py renders cms/toolbar/structure.html for a PageContent object without calling user_can_view_page(). Any staff account can request a restricted page’s structure when CMS_PERMISSION is enabled and the page has view restrictions or CMS_PUBLIC_FOR is set to staff. The response exposes plugin get_short_description() values, including link names, URLs, and text snippets, rather than only the page shape. This issue is fixed in versions 5.0.8.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-54624 https://vulnerability.circl.lu/vuln/ghsa-vgxm-h9gx-h9w7 <p><strong>Affected:</strong> PyPI: django-cms</p> <p>### Summary The structure-board endpoint (`render_object_structure`) renders a page&#39;s plugin structure without verifying that the requesting user is allowed to view the page. The edit and preview endpoints enforce this via `render_page()`, but the structure endpoint does not, allowing a low-privileged staff user to read the plugin structure of a view-restricted page.</p> <p>### Details `render_object_structure` (in `cms/views.py`) loads the `PageContent` object and renders `cms/toolbar/structure.html` directly. Unlike `render_object_endpoint` (used by edit/preview), which renders through `render_pagecontent` → `render_page` and calls `user_can_view_page(request.user, page)` (returning 404 when the user may not view the page), the structure endpoint performs no page-level authorization.</p> <p>The rendered structure board includes each plugin&#39;s `get_short_description()` (e.g. link names/URLs, text snippets), so the content of a restricted page is disclosed, not just its shape.</p> <p>### Impact A staff user (any account with `is_staff=True`) who lacks view permission on a view-restricted page can retrieve that page&#39;s plugin structure and short descriptions by requesting the structure endpoint with the page&#39;s content-type id and object id.</p> <p>This only applies when `CMS_PERMISSION=True` and the page has view restrictions (or `CMS_PUBLIC_FOR=&#39;staff&#39;`). Sites without per-page view restrictions are not affected.</p> <p>### Patches Fixed in 5.0.8: the structure endpoint now enforces `user_can_view_page()…</p> <p><strong>Affected:</strong> PyPI: django-cms</p> <p>### Summary The structure-board endpoint (`render_object_structure`) renders a page&#39;s plugin structure without verifying that the requesting user is allowed to view the page. The edit and preview endpoints enforce this via `render_page()`, but the structure endpoint does not, allowing a low-privileged staff user to read the plugin structure of a view-restricted page.</p> <p>### Details `render_object_structure` (in `cms/views.py`) loads the `PageContent` object and renders `cms/toolbar/structure.html` directly. Unlike `render_object_endpoint` (used by edit/preview), which renders through `render_pagecontent` → `render_page` and calls `user_can_view_page(request.user, page)` (returning 404 when the user may not view the page), the structure endpoint performs no page-level authorization.</p> <p>The rendered structure board includes each plugin&#39;s `get_short_description()` (e.g. link names/URLs, text snippets), so the content of a restricted page is disclosed, not just its shape.</p> <p>### Impact A staff user (any account with `is_staff=True`) who lacks view permission on a view-restricted page can retrieve that page&#39;s plugin structure and short descriptions by requesting the structure endpoint with the page&#39;s content-type id and object id.</p> <p>This only applies when `CMS_PERMISSION=True` and the page has view restrictions (or `CMS_PUBLIC_FOR=&#39;staff&#39;`). Sites without per-page view restrictions are not affected.</p> <p>### Patches Fixed in 5.0.8: the structure endpoint now enforces `user_can_view_page()…</p> https://vulnerability.circl.lu/vuln/ghsa-vgxm-h9gx-h9w7 https://vulnerability.circl.lu/vuln/pysec-2026-3826 <p><strong>Affected:</strong> PyPI: django-cms</p> <p>### Summary The structure-board endpoint (`render_object_structure`) renders a page&#39;s plugin structure without verifying that the requesting user is allowed to view the page. The edit and preview endpoints enforce this via `render_page()`, but the structure endpoint does not, allowing a low-privileged staff user to read the plugin structure of a view-restricted page.</p> <p>### Details `render_object_structure` (in `cms/views.py`) loads the `PageContent` object and renders `cms/toolbar/structure.html` directly. Unlike `render_object_endpoint` (used by edit/preview), which renders through `render_pagecontent` → `render_page` and calls `user_can_view_page(request.user, page)` (returning 404 when the user may not view the page), the structure endpoint performs no page-level authorization.</p> <p>The rendered structure board includes each plugin&#39;s `get_short_description()` (e.g. link names/URLs, text snippets), so the content of a restricted page is disclosed, not just its shape.</p> <p>### Impact A staff user (any account with `is_staff=True`) who lacks view permission on a view-restricted page can retrieve that page&#39;s plugin structure and short descriptions by requesting the structure endpoint with the page&#39;s content-type id and object id.</p> <p>This only applies when `CMS_PERMISSION=True` and the page has view restrictions (or `CMS_PUBLIC_FOR=&#39;staff&#39;`). Sites without per-page view restrictions are not affected.</p> <p>### Patches Fixed in 5.0.8: the structure endpoint now enforces `user_can_view_page()…</p> <p><strong>Affected:</strong> PyPI: django-cms</p> <p>### Summary The structure-board endpoint (`render_object_structure`) renders a page&#39;s plugin structure without verifying that the requesting user is allowed to view the page. The edit and preview endpoints enforce this via `render_page()`, but the structure endpoint does not, allowing a low-privileged staff user to read the plugin structure of a view-restricted page.</p> <p>### Details `render_object_structure` (in `cms/views.py`) loads the `PageContent` object and renders `cms/toolbar/structure.html` directly. Unlike `render_object_endpoint` (used by edit/preview), which renders through `render_pagecontent` → `render_page` and calls `user_can_view_page(request.user, page)` (returning 404 when the user may not view the page), the structure endpoint performs no page-level authorization.</p> <p>The rendered structure board includes each plugin&#39;s `get_short_description()` (e.g. link names/URLs, text snippets), so the content of a restricted page is disclosed, not just its shape.</p> <p>### Impact A staff user (any account with `is_staff=True`) who lacks view permission on a view-restricted page can retrieve that page&#39;s plugin structure and short descriptions by requesting the structure endpoint with the page&#39;s content-type id and object id.</p> <p>This only applies when `CMS_PERMISSION=True` and the page has view restrictions (or `CMS_PUBLIC_FOR=&#39;staff&#39;`). Sites without per-page view restrictions are not affected.</p> <p>### Patches Fixed in 5.0.8: the structure endpoint now enforces `user_can_view_page()…</p> https://vulnerability.circl.lu/vuln/pysec-2026-3826