Vulnerability-Lookup

CVE-2026-61663 (GCVE-0-2026-61663)

Vulnerability from cvelistv5 – Published: 2026-08-20 18:07 – Updated: 2026-08-25 15:16

Title

django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff

Summary

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, render_object_structure fails to authorize non-PageContent objects that use PlaceholderRelationField. An active staff user without cms.use_structure or model-level view or change permission can request the //admin/cms/placeholder/object/<content_type_id>/structure/<object_id>/ endpoint with guessed content_type_id and object_id values. The response discloses placeholder slot names, plugin trees, plugin identifiers, labels, and object existence for frontend-editable objects. The fix applies user_can_view_placeholder_source to the non-PageContent branch while keeping the structure board read-only for view-only users. This issue is fixed in versions 5.0.9.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-25 15:15 UTC

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key
CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root Scorecard

References

4 references

URL	Tags
https://github.com/django-cms/django-cms/security…	x_refsource_CONFIRM
https://github.com/django-cms/django-cms/pull/8703	x_refsource_MISC
https://github.com/django-cms/django-cms/commit/9…	x_refsource_MISC
https://github.com/django-cms/django-cms/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
django-cms	django-cms	Affected: < 5.0.9	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-61663",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T15:15:25.782831Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-25T15:16:01.718Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/django-cms/django-cms/security/advisories/GHSA-8qj2-c6q4-f399"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "django-cms",
          "vendor": "django-cms",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.0.9"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, render_object_structure fails to authorize non-PageContent objects that use PlaceholderRelationField. An active staff user without cms.use_structure or model-level view or change permission can request the //admin/cms/placeholder/object/\u003ccontent_type_id\u003e/structure/\u003cobject_id\u003e/ endpoint with guessed content_type_id and object_id values. The response discloses placeholder slot names, plugin trees, plugin identifiers, labels, and object existence for frontend-editable objects. The fix applies user_can_view_placeholder_source to the non-PageContent branch while keeping the structure board read-only for view-only users. This issue is fixed in versions 5.0.9."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-20T18:07:28.005Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/django-cms/django-cms/security/advisories/GHSA-8qj2-c6q4-f399",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/django-cms/django-cms/security/advisories/GHSA-8qj2-c6q4-f399"
        },
        {
          "name": "https://github.com/django-cms/django-cms/pull/8703",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/django-cms/django-cms/pull/8703"
        },
        {
          "name": "https://github.com/django-cms/django-cms/commit/9c82abfeb25471583e23906ea1ebef9202527b04",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/django-cms/django-cms/commit/9c82abfeb25471583e23906ea1ebef9202527b04"
        },
        {
          "name": "https://github.com/django-cms/django-cms/releases/tag/5.0.9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/django-cms/django-cms/releases/tag/5.0.9"
        }
      ],
      "source": {
        "advisory": "GHSA-8qj2-c6q4-f399",
        "discovery": "UNKNOWN"
      },
      "title": "django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-61663",
    "datePublished": "2026-08-20T18:07:28.005Z",
    "dateReserved": "2026-07-10T18:25:21.467Z",
    "dateUpdated": "2026-08-25T15:16:01.718Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-61663",
      "date": "2026-09-30",
      "epss": "0.00342",
      "percentile": "0.25292"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "django-cms",
                "vendor": "django-cms",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 5.0.9"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, render_object_structure fails to authorize non-PageContent objects that use PlaceholderRelationField. An active staff user without cms.use_structure or model-level view or change permission can request the //admin/cms/placeholder/object/\u003ccontent_type_id\u003e/structure/\u003cobject_id\u003e/ endpoint with guessed content_type_id and object_id values. The response discloses placeholder slot names, plugin trees, plugin identifiers, labels, and object existence for frontend-editable objects. The fix applies user_can_view_placeholder_source to the non-PageContent branch while keeping the structure board read-only for view-only users. This issue is fixed in versions 5.0.9."
          }
        ],
        "id": "CVE-2026-61663",
        "lastModified": "2026-09-09T21:19:49.197",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 1.4,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-61663",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T15:15:25.782831Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-08-20T19:16:56.823",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/django-cms/django-cms/commit/9c82abfeb25471583e23906ea1ebef9202527b04"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/django-cms/django-cms/pull/8703"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/django-cms/django-cms/releases/tag/5.0.9"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/django-cms/django-cms/security/advisories/GHSA-8qj2-c6q4-f399"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/django-cms/django-cms/security/advisories/GHSA-8qj2-c6q4-f399"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-639"
              },
              {
                "lang": "en",
                "value": "CWE-862"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-61663",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-25T15:15:25.782831Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-25T15:15:52.933Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/django-cms/django-cms/security/advisories/GHSA-8qj2-c6q4-f399"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "django-cms",
              "vendor": "django-cms",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 5.0.9"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, render_object_structure fails to authorize non-PageContent objects that use PlaceholderRelationField. An active staff user without cms.use_structure or model-level view or change permission can request the //admin/cms/placeholder/object/\u003ccontent_type_id\u003e/structure/\u003cobject_id\u003e/ endpoint with guessed content_type_id and object_id values. The response discloses placeholder slot names, plugin trees, plugin identifiers, labels, and object existence for frontend-editable objects. The fix applies user_can_view_placeholder_source to the non-PageContent branch while keeping the structure board read-only for view-only users. This issue is fixed in versions 5.0.9."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-639",
                  "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-862",
                  "description": "CWE-862: Missing Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-20T18:07:28.005Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/django-cms/django-cms/security/advisories/GHSA-8qj2-c6q4-f399",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/django-cms/django-cms/security/advisories/GHSA-8qj2-c6q4-f399"
            },
            {
              "name": "https://github.com/django-cms/django-cms/pull/8703",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/django-cms/django-cms/pull/8703"
            },
            {
              "name": "https://github.com/django-cms/django-cms/commit/9c82abfeb25471583e23906ea1ebef9202527b04",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/django-cms/django-cms/commit/9c82abfeb25471583e23906ea1ebef9202527b04"
            },
            {
              "name": "https://github.com/django-cms/django-cms/releases/tag/5.0.9",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/django-cms/django-cms/releases/tag/5.0.9"
            }
          ],
          "source": {
            "advisory": "GHSA-8qj2-c6q4-f399",
            "discovery": "UNKNOWN"
          },
          "title": "django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-61663",
        "datePublished": "2026-08-20T18:07:28.005Z",
        "dateReserved": "2026-07-10T18:25:21.467Z",
        "dateUpdated": "2026-08-25T15:16:01.718Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-61663

Vulnerability from fkie_nvd - Published: 2026-08-20 19:16 - Updated: 2026-09-09 21:19

Severity

4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/django-cms/django-cms/commit/9c82abfeb25471583e23906ea1ebef9202527b04
	security-advisories@github.com	https://github.com/django-cms/django-cms/pull/8703
	security-advisories@github.com	https://github.com/django-cms/django-cms/releases/tag/5.0.9
	security-advisories@github.com	https://github.com/django-cms/django-cms/security/advisories/GHSA-8qj2-c6q4-f399
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/django-cms/django-cms/security/advisories/GHSA-8qj2-c6q4-f399

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "django-cms",
          "vendor": "django-cms",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.0.9"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, render_object_structure fails to authorize non-PageContent objects that use PlaceholderRelationField. An active staff user without cms.use_structure or model-level view or change permission can request the //admin/cms/placeholder/object/\u003ccontent_type_id\u003e/structure/\u003cobject_id\u003e/ endpoint with guessed content_type_id and object_id values. The response discloses placeholder slot names, plugin trees, plugin identifiers, labels, and object existence for frontend-editable objects. The fix applies user_can_view_placeholder_source to the non-PageContent branch while keeping the structure board read-only for view-only users. This issue is fixed in versions 5.0.9."
    }
  ],
  "id": "CVE-2026-61663",
  "lastModified": "2026-09-09T21:19:49.197",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-61663",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-25T15:15:25.782831Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-20T19:16:56.823",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/django-cms/django-cms/commit/9c82abfeb25471583e23906ea1ebef9202527b04"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/django-cms/django-cms/pull/8703"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/django-cms/django-cms/releases/tag/5.0.9"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/django-cms/django-cms/security/advisories/GHSA-8qj2-c6q4-f399"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/django-cms/django-cms/security/advisories/GHSA-8qj2-c6q4-f399"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        },
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-8QJ2-C6Q4-F399

Vulnerability from github – Published: 2026-08-20 18:42 – Updated: 2026-08-20 18:42

Summary

django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff

Details

Summary

The django-cms frontend-editing structure endpoint

GET /<lang>/admin/cms/placeholder/object/<content_type_id>/structure/<object_id>/

did not perform an object-level authorization check for non-PageContent objects. Any authenticated, active staff user could request the structure endpoint for a frontend-editable object (a model using PlaceholderRelationField) and read its placeholder/plugin structure, even without permission to change that object and without the cms.use_structure permission that the toolbar UI requires before offering structure mode.

PageContent objects were already protected (a page-view check added in GHSA/PR #8644); this advisory covers the remaining non-PageContent branch of the same view.

Severity

The issue is staff-gated and read-only, disclosing CMS structure metadata (placeholder slot names, plugin tree, plugin identifiers/labels, object existence) rather than write access or arbitrary field data.

Affected versions

django-cms >= 4.0.0, <= 5.0.x and 5.1.0a1 (the vulnerable non-PageContent branch was introduced with the frontend-editing endpoints in 4.0)

Patched versions

django-cms TODO: 5.0.9

Preconditions

An authenticated, active staff account (is_staff=True).
The deployment exposes a non-PageContent model with django-cms placeholders / frontend editing (e.g. via PlaceholderRelationField).
The attacker can guess or enumerate the target content_type_id and object id.
The attacker needs no model/object change permission and no cms.use_structure permission.

Impact

A low-privileged staff user can read the editorial placeholder/plugin structure of non-PageContent objects they are not authorized to edit through the toolbar. Depending on the installed plugins and templates this may reveal placeholder names, plugin layout, plugin identifiers and the existence of objects owned by other staff users or teams. This is most relevant for deployments using third-party or custom django-cms apps that expose frontend-editable objects outside the page tree.

Proof of concept

Using django-cms' own test model placeholder_relation_field_app.FancyPoll (a non-PageContent model with a PlaceholderRelationField):

target = FancyPoll.objects.create(name="private-fancy-poll")
placeholder = rescan_placeholders_for_obj(target)["content"]
attacker = self._create_user("low_staff", is_staff=True, is_superuser=False)
# attacker has neither change_fancypoll nor cms.use_structure

with self.login_user_context(attacker):
    response = self.client.get(get_object_structure_url(target, language="en"))

# Before fix: HTTP 200, body contains '"placeholder_id": "<pk>"'
# After fix:  HTTP 404, structure not disclosed

Patch

render_object_structure now authorizes the non-PageContent branch, mirroring Placeholder.has_change_permission at the object level (honouring a custom has_placeholder_change_permission hook, otherwise falling back to the model/object change permission) and returning 404 when the user is not authorized:

else:
    content_type_obj = content_type.get_object_for_this_type(pk=object_id)
    if not _can_change_placeholder_object(request.user, content_type_obj):
        raise Http404

Workarounds

No configuration workaround. Deployments that do not register any non-PageContent frontend-editable model are not affected. Otherwise, upgrade to a patched release.

Credit

Reported by doanmanhducz.

Severity

4.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "django-cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.0.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-61663"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-20T18:42:50Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe django-cms frontend-editing structure endpoint\n\n```\nGET /\u003clang\u003e/admin/cms/placeholder/object/\u003ccontent_type_id\u003e/structure/\u003cobject_id\u003e/\n```\n\ndid not perform an object-level authorization check for **non-`PageContent`** objects. Any authenticated, active staff user could request the structure endpoint for a frontend-editable object (a model using `PlaceholderRelationField`) and read its placeholder/plugin structure, even without permission to change that object and without the `cms.use_structure` permission that the toolbar UI requires before offering structure mode.\n\n`PageContent` objects were already protected (a page-view check added in GHSA/PR #8644); this advisory covers the remaining non-`PageContent` branch of the same view.\n\n## Severity\n\nThe issue is staff-gated and read-only, disclosing CMS structure metadata (placeholder slot names, plugin tree, plugin identifiers/labels, object existence) rather than write access or arbitrary field data.\n\n## Affected versions\n\n- django-cms `\u003e= 4.0.0, \u003c= 5.0.x` and `5.1.0a1`\n  (the vulnerable non-`PageContent` branch was introduced with the frontend-editing endpoints in 4.0)\n\n## Patched versions\n\n- django-cms TODO: 5.0.9\n\n## Preconditions\n\n- An authenticated, active staff account (`is_staff=True`).\n- The deployment exposes a non-`PageContent` model with django-cms placeholders / frontend editing (e.g. via `PlaceholderRelationField`).\n- The attacker can guess or enumerate the target `content_type_id` and object id.\n- The attacker needs **no** model/object change permission and **no** `cms.use_structure` permission.\n\n## Impact\n\nA low-privileged staff user can read the editorial placeholder/plugin structure of non-`PageContent` objects they are not authorized to edit through the toolbar. Depending on the installed plugins and templates this may reveal placeholder names, plugin layout, plugin identifiers and the existence of objects owned by other staff users or teams. This is most relevant for deployments using third-party or custom django-cms apps that expose frontend-editable objects outside the page tree.\n\n## Proof of concept\n\nUsing django-cms\u0027 own test model `placeholder_relation_field_app.FancyPoll` (a non-`PageContent` model with a `PlaceholderRelationField`):\n\n```python\ntarget = FancyPoll.objects.create(name=\"private-fancy-poll\")\nplaceholder = rescan_placeholders_for_obj(target)[\"content\"]\nattacker = self._create_user(\"low_staff\", is_staff=True, is_superuser=False)\n# attacker has neither change_fancypoll nor cms.use_structure\n\nwith self.login_user_context(attacker):\n    response = self.client.get(get_object_structure_url(target, language=\"en\"))\n\n# Before fix: HTTP 200, body contains \u0027\"placeholder_id\": \"\u003cpk\u003e\"\u0027\n# After fix:  HTTP 404, structure not disclosed\n```\n\n## Patch\n\n`render_object_structure` now authorizes the non-`PageContent` branch, mirroring\n`Placeholder.has_change_permission` at the object level (honouring a custom\n`has_placeholder_change_permission` hook, otherwise falling back to the model/object\nchange permission) and returning `404` when the user is not authorized:\n\n```python\nelse:\n    content_type_obj = content_type.get_object_for_this_type(pk=object_id)\n    if not _can_change_placeholder_object(request.user, content_type_obj):\n        raise Http404\n```\n\n## Workarounds\n\nNo configuration workaround. Deployments that do not register any non-`PageContent`\nfrontend-editable model are not affected. Otherwise, upgrade to a patched release.\n\n## Credit\n\nReported by **doanmanhducz**.",
  "id": "GHSA-8qj2-c6q4-f399",
  "modified": "2026-08-20T18:42:50Z",
  "published": "2026-08-20T18:42:50Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/django-cms/django-cms/security/advisories/GHSA-8qj2-c6q4-f399"
    },
    {
      "type": "WEB",
      "url": "https://github.com/django-cms/django-cms/pull/8703"
    },
    {
      "type": "WEB",
      "url": "https://github.com/django-cms/django-cms/commit/9c82abfeb25471583e23906ea1ebef9202527b04"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/django-cms/django-cms"
    },
    {
      "type": "WEB",
      "url": "https://github.com/django-cms/django-cms/releases/tag/5.0.9"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff"
}

PYSEC-2026-3823

Vulnerability from pysec - Published: 2026-09-10 09:44 - Updated: 2026-09-10 11:02

Details

Summary

The django-cms frontend-editing structure endpoint

GET /<lang>/admin/cms/placeholder/object/<content_type_id>/structure/<object_id>/

PageContent objects were already protected (a page-view check added in GHSA/PR #8644); this advisory covers the remaining non-PageContent branch of the same view.

Severity

Affected versions

django-cms >= 4.0.0, <= 5.0.x and 5.1.0a1 (the vulnerable non-PageContent branch was introduced with the frontend-editing endpoints in 4.0)

Patched versions

django-cms TODO: 5.0.9

Preconditions

An authenticated, active staff account (is_staff=True).
The deployment exposes a non-PageContent model with django-cms placeholders / frontend editing (e.g. via PlaceholderRelationField).
The attacker can guess or enumerate the target content_type_id and object id.
The attacker needs no model/object change permission and no cms.use_structure permission.

Impact

Proof of concept

Using django-cms' own test model placeholder_relation_field_app.FancyPoll (a non-PageContent model with a PlaceholderRelationField):

target = FancyPoll.objects.create(name="private-fancy-poll")
placeholder = rescan_placeholders_for_obj(target)["content"]
attacker = self._create_user("low_staff", is_staff=True, is_superuser=False)
# attacker has neither change_fancypoll nor cms.use_structure

with self.login_user_context(attacker):
    response = self.client.get(get_object_structure_url(target, language="en"))

# Before fix: HTTP 200, body contains '"placeholder_id": "<pk>"'
# After fix:  HTTP 404, structure not disclosed

Patch

else:
    content_type_obj = content_type.get_object_for_this_type(pk=object_id)
    if not _can_change_placeholder_object(request.user, content_type_obj):
        raise Http404

Workarounds

No configuration workaround. Deployments that do not register any non-PageContent frontend-editable model are not affected. Otherwise, upgrade to a patched release.

Credit

Reported by doanmanhducz.

Severity

4.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Impacted products

Name	purl
django-cms	pkg:pypi/django-cms

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "django-cms",
        "purl": "pkg:pypi/django-cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.0.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.0.1",
        "2.0.2",
        "2.1.1",
        "2.1.2",
        "2.1.3",
        "2.1.4",
        "2.1.5",
        "2.2",
        "2.2.1",
        "2.3.1",
        "2.3.2",
        "2.3.3",
        "2.3.4",
        "2.3.5",
        "2.3.6",
        "2.3.7",
        "2.3.8",
        "2.4.0",
        "2.4.1",
        "2.4.2",
        "2.4.3",
        "3.0",
        "3.0.1",
        "3.0.10",
        "3.0.11",
        "3.0.12",
        "3.0.13",
        "3.0.14",
        "3.0.15",
        "3.0.16",
        "3.0.17",
        "3.0.18",
        "3.0.2",
        "3.0.3",
        "3.0.4",
        "3.0.5",
        "3.0.6",
        "3.0.7",
        "3.0.8",
        "3.0.9",
        "3.1.0",
        "3.1.0.b1",
        "3.1.0rc1",
        "3.1.0rc2",
        "3.1.1",
        "3.1.2",
        "3.1.3",
        "3.1.4",
        "3.1.5",
        "3.1.6",
        "3.1.7",
        "3.10.0",
        "3.10.0rc1",
        "3.10.0rc2",
        "3.10.1",
        "3.10.1rc1",
        "3.11.0",
        "3.11.1",
        "3.11.10",
        "3.11.11",
        "3.11.1rc1",
        "3.11.2",
        "3.11.3",
        "3.11.4",
        "3.11.5",
        "3.11.6",
        "3.11.7",
        "3.11.8",
        "3.11.9",
        "3.2.0",
        "3.2.1",
        "3.2.2",
        "3.2.3",
        "3.2.4",
        "3.2.5",
        "3.3.0",
        "3.3.0rc2",
        "3.3.0rc3",
        "3.3.0rc4",
        "3.3.1",
        "3.3.2",
        "3.3.3",
        "3.3.4",
        "3.4.0",
        "3.4.1",
        "3.4.2",
        "3.4.3",
        "3.4.4",
        "3.4.5",
        "3.4.6",
        "3.4.7",
        "3.5.0",
        "3.5.1",
        "3.5.2",
        "3.5.3",
        "3.5.4",
        "3.6.0",
        "3.6.0rc1",
        "3.6.0rc3",
        "3.6.1",
        "3.7.0",
        "3.7.0rc1",
        "3.7.0rc2",
        "3.7.1",
        "3.7.2",
        "3.7.3",
        "3.7.4",
        "3.8.0",
        "3.8.0rc1",
        "3.8.1",
        "3.8.2",
        "3.9.0",
        "3.9.0rc1",
        "3.9.0rc2",
        "3.9.0rc3",
        "4.1.0",
        "4.1.0rc1",
        "4.1.0rc2",
        "4.1.0rc3",
        "4.1.0rc4",
        "4.1.0rc5",
        "4.1.1",
        "4.1.10",
        "4.1.11",
        "4.1.2",
        "4.1.3",
        "4.1.4",
        "4.1.5",
        "4.1.6",
        "4.1.7",
        "4.1.9",
        "5.0.0",
        "5.0.0a1",
        "5.0.1",
        "5.0.2",
        "5.0.3",
        "5.0.4",
        "5.0.5",
        "5.0.6",
        "5.0.7",
        "5.0.8"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-61663",
    "GHSA-8qj2-c6q4-f399"
  ],
  "details": "## Summary\n\nThe django-cms frontend-editing structure endpoint\n\n```\nGET /\u003clang\u003e/admin/cms/placeholder/object/\u003ccontent_type_id\u003e/structure/\u003cobject_id\u003e/\n```\n\ndid not perform an object-level authorization check for **non-`PageContent`** objects. Any authenticated, active staff user could request the structure endpoint for a frontend-editable object (a model using `PlaceholderRelationField`) and read its placeholder/plugin structure, even without permission to change that object and without the `cms.use_structure` permission that the toolbar UI requires before offering structure mode.\n\n`PageContent` objects were already protected (a page-view check added in GHSA/PR #8644); this advisory covers the remaining non-`PageContent` branch of the same view.\n\n## Severity\n\nThe issue is staff-gated and read-only, disclosing CMS structure metadata (placeholder slot names, plugin tree, plugin identifiers/labels, object existence) rather than write access or arbitrary field data.\n\n## Affected versions\n\n- django-cms `\u003e= 4.0.0, \u003c= 5.0.x` and `5.1.0a1`\n  (the vulnerable non-`PageContent` branch was introduced with the frontend-editing endpoints in 4.0)\n\n## Patched versions\n\n- django-cms TODO: 5.0.9\n\n## Preconditions\n\n- An authenticated, active staff account (`is_staff=True`).\n- The deployment exposes a non-`PageContent` model with django-cms placeholders / frontend editing (e.g. via `PlaceholderRelationField`).\n- The attacker can guess or enumerate the target `content_type_id` and object id.\n- The attacker needs **no** model/object change permission and **no** `cms.use_structure` permission.\n\n## Impact\n\nA low-privileged staff user can read the editorial placeholder/plugin structure of non-`PageContent` objects they are not authorized to edit through the toolbar. Depending on the installed plugins and templates this may reveal placeholder names, plugin layout, plugin identifiers and the existence of objects owned by other staff users or teams. This is most relevant for deployments using third-party or custom django-cms apps that expose frontend-editable objects outside the page tree.\n\n## Proof of concept\n\nUsing django-cms\u0027 own test model `placeholder_relation_field_app.FancyPoll` (a non-`PageContent` model with a `PlaceholderRelationField`):\n\n```python\ntarget = FancyPoll.objects.create(name=\"private-fancy-poll\")\nplaceholder = rescan_placeholders_for_obj(target)[\"content\"]\nattacker = self._create_user(\"low_staff\", is_staff=True, is_superuser=False)\n# attacker has neither change_fancypoll nor cms.use_structure\n\nwith self.login_user_context(attacker):\n    response = self.client.get(get_object_structure_url(target, language=\"en\"))\n\n# Before fix: HTTP 200, body contains \u0027\"placeholder_id\": \"\u003cpk\u003e\"\u0027\n# After fix:  HTTP 404, structure not disclosed\n```\n\n## Patch\n\n`render_object_structure` now authorizes the non-`PageContent` branch, mirroring\n`Placeholder.has_change_permission` at the object level (honouring a custom\n`has_placeholder_change_permission` hook, otherwise falling back to the model/object\nchange permission) and returning `404` when the user is not authorized:\n\n```python\nelse:\n    content_type_obj = content_type.get_object_for_this_type(pk=object_id)\n    if not _can_change_placeholder_object(request.user, content_type_obj):\n        raise Http404\n```\n\n## Workarounds\n\nNo configuration workaround. Deployments that do not register any non-`PageContent`\nfrontend-editable model are not affected. Otherwise, upgrade to a patched release.\n\n## Credit\n\nReported by **doanmanhducz**.",
  "id": "PYSEC-2026-3823",
  "modified": "2026-09-10T11:02:03.561816Z",
  "published": "2026-09-10T09:44:52.754662Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/django-cms/django-cms/security/advisories/GHSA-8qj2-c6q4-f399"
    },
    {
      "type": "WEB",
      "url": "https://github.com/django-cms/django-cms/pull/8703"
    },
    {
      "type": "WEB",
      "url": "https://github.com/django-cms/django-cms/commit/9c82abfeb25471583e23906ea1ebef9202527b04"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/django-cms/django-cms"
    },
    {
      "type": "WEB",
      "url": "https://github.com/django-cms/django-cms/releases/tag/5.0.9"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/django-cms"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-8qj2-c6q4-f399"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61663"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-61663 (GCVE-0-2026-61663)

FKIE_CVE-2026-61663

GHSA-8QJ2-C6Q4-F399

Summary

Severity

Affected versions

Patched versions

Preconditions

Impact

Proof of concept

Patch

Workarounds

Credit

PYSEC-2026-3823

Summary

Severity

Affected versions

Patched versions

Preconditions

Impact

Proof of concept

Patch

Workarounds

Credit

Tags

Sightings

Nomenclature

Related by attack behaviour