https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 23:33:42 +0000 https://vulnerability.circl.lu/vuln/cve-2026-63003 <p><strong>Affected:</strong> django-cms</p> <p>django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, page duplication lacks an object-level authorization check on the source page. In cms/admin/forms.py, DuplicatePageForm.source accepts any Page, the AddPageForm constructor does not narrow a hidden source field, AddPageForm.clean does not validate the source against the user, and AddPageForm.save calls from_source. In cms/admin/pageadmin.py, duplicate and PageAdmin.has_add_permission check only whether a staff user may add a page. A crafted source value can therefore copy every placeholder and plugin from an unauthorized page with permissions=False, stripping source view restrictions and exposing content across sites or restricted subtrees when CMS_PERMISSION is enabled. This issue is fixed in versions 5.0.9.</p> <p><strong>Affected:</strong> django-cms</p> <p>django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, page duplication lacks an object-level authorization check on the source page. In cms/admin/forms.py, DuplicatePageForm.source accepts any Page, the AddPageForm constructor does not narrow a hidden source field, AddPageForm.clean does not validate the source against the user, and AddPageForm.save calls from_source. In cms/admin/pageadmin.py, duplicate and PageAdmin.has_add_permission check only whether a staff user may add a page. A crafted source value can therefore copy every placeholder and plugin from an unauthorized page with permissions=False, stripping source view restrictions and exposing content across sites or restricted subtrees when CMS_PERMISSION is enabled. This issue is fixed in versions 5.0.9.</p> https://vulnerability.circl.lu/vuln/cve-2026-63003 https://vulnerability.circl.lu/vuln/ghsa-6x92-6vx4-5fwr <p><strong>Affected:</strong> PyPI: django-cms</p> <p>## Impact</p> <p>The only authorization gate on the duplicate flow is `PageAdmin.has_add_permission`, which checks `user_can_add_page(user, site)` / `user_can_add_subpage(...)` — i.e. *“may this user create a page at all”*. Nothing checks the user’s relationship to the page being copied:</p> <p>- `cms/admin/forms.py` — `DuplicatePageForm.source = ModelChoiceField(queryset=Page.objects.all(), widget=HiddenInput())` spans **every page in the database, on every site**. - `cms/admin/forms.py` — `AddPageForm.__init__` returns early when the `source` widget is hidden, so the queryset is **never narrowed** to the user’s site/subtree. - `cms/admin/forms.py` — `AddPageForm.clean()` validates only URL uniqueness; `source` is never validated against the user. - `cms/admin/pageadmin.py` — `duplicate()` seeds `source` from the URL **only on GET**; on POST the value comes entirely from the request body. - `cms/admin/forms.py` — `AddPageForm.save()` → `from_source()` performs `source.copy(..., permissions=False)` and copies **every placeholder and all plugins** of `source` into a new page on the attacker’s site. Because `permissions=False` drops the source’s view restrictions, the resulting copy is fully readable by the attacker.</p> <p>This crosses a real privilege boundary: a staff user restricted (via `CMS_PERMISSION`) to their own site or subtree can exfiltrate the content of restricted pages and of pages belonging to other tenants.</p> <p>**Read-back is trivial (verified):** the copy is created…</p> <p><strong>Affected:</strong> PyPI: django-cms</p> <p>## Impact</p> <p>The only authorization gate on the duplicate flow is `PageAdmin.has_add_permission`, which checks `user_can_add_page(user, site)` / `user_can_add_subpage(...)` — i.e. *“may this user create a page at all”*. Nothing checks the user’s relationship to the page being copied:</p> <p>- `cms/admin/forms.py` — `DuplicatePageForm.source = ModelChoiceField(queryset=Page.objects.all(), widget=HiddenInput())` spans **every page in the database, on every site**. - `cms/admin/forms.py` — `AddPageForm.__init__` returns early when the `source` widget is hidden, so the queryset is **never narrowed** to the user’s site/subtree. - `cms/admin/forms.py` — `AddPageForm.clean()` validates only URL uniqueness; `source` is never validated against the user. - `cms/admin/pageadmin.py` — `duplicate()` seeds `source` from the URL **only on GET**; on POST the value comes entirely from the request body. - `cms/admin/forms.py` — `AddPageForm.save()` → `from_source()` performs `source.copy(..., permissions=False)` and copies **every placeholder and all plugins** of `source` into a new page on the attacker’s site. Because `permissions=False` drops the source’s view restrictions, the resulting copy is fully readable by the attacker.</p> <p>This crosses a real privilege boundary: a staff user restricted (via `CMS_PERMISSION`) to their own site or subtree can exfiltrate the content of restricted pages and of pages belonging to other tenants.</p> <p>**Read-back is trivial (verified):** the copy is created…</p> https://vulnerability.circl.lu/vuln/ghsa-6x92-6vx4-5fwr