https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 15:20:12 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-54622 <p>django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the copy_plugins endpoint in cms/admin/placeholderadmin.py authorizes only the destination clipboard. The _copy_plugin_to_clipboard and _copy_placeholder_to_clipboard paths accept source_placeholder_id and source_plugin_id values but use has_copy_plugins_permission and check_source only for the requesting user’s clipboard, without validating the source placeholder. Under CMS_PERMISSION, a staff user with the global add permission for a plugin type can copy plugins from an unauthorized page or placeholder into the user’s clipboard and read secret text, link names, and URLs. This issue is fixed in versions 5.0.8.</p> <p>django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the copy_plugins endpoint in cms/admin/placeholderadmin.py authorizes only the destination clipboard. The _copy_plugin_to_clipboard and _copy_placeholder_to_clipboard paths accept source_placeholder_id and source_plugin_id values but use has_copy_plugins_permission and check_source only for the requesting user’s clipboard, without validating the source placeholder. Under CMS_PERMISSION, a staff user with the global add permission for a plugin type can copy plugins from an unauthorized page or placeholder into the user’s clipboard and read secret text, link names, and URLs. This issue is fixed in versions 5.0.8.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-54622 https://vulnerability.circl.lu/vuln/ghsa-4xfr-4p46-gc6p <p><strong>Affected:</strong> PyPI: django-cms</p> <p>### Summary The clipboard copy paths of the `copy_plugins` admin endpoint validate only the target (the user&#39;s own clipboard) and skip source-side authorization. A staff user can copy plugins out of a placeholder they have no permission on into their clipboard, then read the (secret) content.</p> <p>### Details In `cms/admin/placeholderadmin.py`, `_copy_plugin_to_clipboard` and `_copy_placeholder_to_clipboard` check `has_copy_plugins_permission`, which only evaluates `request.toolbar.clipboard.has_add_plugins_permission(...)` — the clipboard belongs to the requesting user, and `check_source` is likewise applied only to the clipboard. The source placeholder identified by the attacker-supplied `source_placeholder_id` / `source_plugin_id` is never authorization-checked. (The placeholder-to-placeholder copy path, `has_copy_from_placeholder_permission`, correctly checks both sides.)</p> <p>### Impact A staff user holding the global add permission for a plugin type, but with no access to a given placeholder/page, can copy that placeholder&#39;s plugins into their own clipboard and read content (e.g. link names/URLs, text) they cannot reach through the normal edit endpoints.</p> <p>Requires `CMS_PERMISSION=True` with per-placeholder/page restrictions.</p> <p>### Patches Fixed in 5.0.8: the clipboard copy paths now also verify source-side permission (`has_add_plugins_permission` + `check_source` on the source placeholder), matching placeholder-to-placeholder copy.</p> <p>### Work…</p> <p><strong>Affected:</strong> PyPI: django-cms</p> <p>### Summary The clipboard copy paths of the `copy_plugins` admin endpoint validate only the target (the user&#39;s own clipboard) and skip source-side authorization. A staff user can copy plugins out of a placeholder they have no permission on into their clipboard, then read the (secret) content.</p> <p>### Details In `cms/admin/placeholderadmin.py`, `_copy_plugin_to_clipboard` and `_copy_placeholder_to_clipboard` check `has_copy_plugins_permission`, which only evaluates `request.toolbar.clipboard.has_add_plugins_permission(...)` — the clipboard belongs to the requesting user, and `check_source` is likewise applied only to the clipboard. The source placeholder identified by the attacker-supplied `source_placeholder_id` / `source_plugin_id` is never authorization-checked. (The placeholder-to-placeholder copy path, `has_copy_from_placeholder_permission`, correctly checks both sides.)</p> <p>### Impact A staff user holding the global add permission for a plugin type, but with no access to a given placeholder/page, can copy that placeholder&#39;s plugins into their own clipboard and read content (e.g. link names/URLs, text) they cannot reach through the normal edit endpoints.</p> <p>Requires `CMS_PERMISSION=True` with per-placeholder/page restrictions.</p> <p>### Patches Fixed in 5.0.8: the clipboard copy paths now also verify source-side permission (`has_add_plugins_permission` + `check_source` on the source placeholder), matching placeholder-to-placeholder copy.</p> <p>### Work…</p> https://vulnerability.circl.lu/vuln/ghsa-4xfr-4p46-gc6p https://vulnerability.circl.lu/vuln/pysec-2026-3820 <p><strong>Affected:</strong> PyPI: django-cms</p> <p>### Summary The clipboard copy paths of the `copy_plugins` admin endpoint validate only the target (the user&#39;s own clipboard) and skip source-side authorization. A staff user can copy plugins out of a placeholder they have no permission on into their clipboard, then read the (secret) content.</p> <p>### Details In `cms/admin/placeholderadmin.py`, `_copy_plugin_to_clipboard` and `_copy_placeholder_to_clipboard` check `has_copy_plugins_permission`, which only evaluates `request.toolbar.clipboard.has_add_plugins_permission(...)` — the clipboard belongs to the requesting user, and `check_source` is likewise applied only to the clipboard. The source placeholder identified by the attacker-supplied `source_placeholder_id` / `source_plugin_id` is never authorization-checked. (The placeholder-to-placeholder copy path, `has_copy_from_placeholder_permission`, correctly checks both sides.)</p> <p>### Impact A staff user holding the global add permission for a plugin type, but with no access to a given placeholder/page, can copy that placeholder&#39;s plugins into their own clipboard and read content (e.g. link names/URLs, text) they cannot reach through the normal edit endpoints.</p> <p>Requires `CMS_PERMISSION=True` with per-placeholder/page restrictions.</p> <p>### Patches Fixed in 5.0.8: the clipboard copy paths now also verify source-side permission (`has_add_plugins_permission` + `check_source` on the source placeholder), matching placeholder-to-placeholder copy.</p> <p>### Work…</p> <p><strong>Affected:</strong> PyPI: django-cms</p> <p>### Summary The clipboard copy paths of the `copy_plugins` admin endpoint validate only the target (the user&#39;s own clipboard) and skip source-side authorization. A staff user can copy plugins out of a placeholder they have no permission on into their clipboard, then read the (secret) content.</p> <p>### Details In `cms/admin/placeholderadmin.py`, `_copy_plugin_to_clipboard` and `_copy_placeholder_to_clipboard` check `has_copy_plugins_permission`, which only evaluates `request.toolbar.clipboard.has_add_plugins_permission(...)` — the clipboard belongs to the requesting user, and `check_source` is likewise applied only to the clipboard. The source placeholder identified by the attacker-supplied `source_placeholder_id` / `source_plugin_id` is never authorization-checked. (The placeholder-to-placeholder copy path, `has_copy_from_placeholder_permission`, correctly checks both sides.)</p> <p>### Impact A staff user holding the global add permission for a plugin type, but with no access to a given placeholder/page, can copy that placeholder&#39;s plugins into their own clipboard and read content (e.g. link names/URLs, text) they cannot reach through the normal edit endpoints.</p> <p>Requires `CMS_PERMISSION=True` with per-placeholder/page restrictions.</p> <p>### Patches Fixed in 5.0.8: the clipboard copy paths now also verify source-side permission (`has_add_plugins_permission` + `check_source` on the source placeholder), matching placeholder-to-placeholder copy.</p> <p>### Work…</p> https://vulnerability.circl.lu/vuln/pysec-2026-3820