Most recent entries from all

fkie_cve-2026-61663

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, render_object_structure fails to authorize non-PageContent objects that use PlaceholderRelationField. An active staff user without cms.use_structure or model-level view or change permission can request the //admin/cms/placeholder/object/<content_type_id>/structure/<object_id>/ endpoint with guessed content_type_id and object_id values. The response discloses placeholder slot names, plugin trees, plugin identifiers, labels, and object existence for frontend-editable objects. The fix applies user_can_view_placeholder_source to the non-PageContent branch while keeping the structure board read-only for view-only users. This issue is fixed in versions 5.0.9.

GHSA-8qj2-c6q4-f399 — django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-p…

Affected: PyPI: django-cms

## Summary

The django-cms frontend-editing structure endpoint

``` GET /<lang>/admin/cms/placeholder/object/<content_type_id>/structure/<object_id>/ ```

did not perform an object-level authorization check for **non-`PageContent`** objects. Any authenticated, active staff user could request the structure endpoint for a frontend-editable object (a model using `PlaceholderRelationField`) and read its placeholder/plugin structure, even without permission to change that object and without the `cms.use_structure` permission that the toolbar UI requires before offering structure mode.

`PageContent` objects were already protected (a page-view check added in GHSA/PR #8644); this advisory covers the remaining non-`PageContent` branch of the same view.

## Severity

The issue is staff-gated and read-only, disclosing CMS structure metadata (placeholder slot names, plugin tree, plugin identifiers/labels, object existence) rather than write access or arbitrary field data.

## Affected versions

- django-cms `>= 4.0.0, <= 5.0.x` and `5.1.0a1` (the vulnerable non-`PageContent` branch was introduced with the frontend-editing endpoints in 4.0)

## Patched versions

- django-cms TODO: 5.0.9

## Preconditions

- An authenticated, active staff account (`is_staff=True`). - The deployment exposes a non-`PageContent` model with django-cms placeholders / frontend editing (e.g. via `PlaceholderRelationField`). - The attacker can guess or enumerate the target `content_type_id` and object id. - Th…

PYSEC-2026-3823 — django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-p…