CVE-2026-54625
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
django CMS before 5.0.8 and 5.1.0 ignores request headers declared by plugins through get_vary_cache_on() when generating cache keys. This causes different users to receive content intended for others.
Risk Assessment
An attacker can prime the cache with attacker-chosen content, and users may receive request-specific content from other users, potentially leading to data leakage or content manipulation.
Recommendation
Upgrade to version 5.0.8 or 5.1.0, which contain the fix.
Other vulnerabilities in django CMS
See all- CVE-2015-5081High
The CSRF vulnerability in django CMS before version 3.0.14 and 3.1.x before 3.1.1 allows remote attackers to manipulate privileged users into performing unknown actions.
- CVE-2026-75526Medium
django CMS from 5.0.8 until 5.0.9 has a vulnerability where ContentRenderer.render_placeholder in cms/plugin_rendering.py can pass stored, attacker-controlled values to ContentRenderer.render_exception when plugin rendering fails in edit mode. Values from get_short_description(), the exception message, the placeholder, or placeholder.source are interpolated into a cms-rendering-exception heading and later returned through mark_safe. Because the heading is not escaped, stored HTML executes in an editor’s browser, and settings.DEBUG does not prevent the custom heading from rendering.
- CVE-2026-63003Medium
django CMS prior to 5.0.9 has a vulnerability in page duplication that lacks an object-level authorization check on the source page. In cms/admin/forms.py, DuplicatePageForm.source accepts any Page, the AddPageForm constructor does not narrow a hidden source field, AddPageForm.clean does not validate the source against the user, and AddPageForm.save calls from_source. In cms/admin/pageadmin.py, duplicate and PageAdmin.has_add_permission check only whether a staff user may add a page. A crafted source value can therefore copy every placeholder and plugin from an unauthorized page with permissions=False, stripping source view restrictions and exposing content across sites or restricted subtrees when CMS_PERMISSION is enabled.
- CVE-2026-61663Medium
django CMS prior to 5.0.9 has a vulnerability in render_object_structure that fails to authorize non-PageContent objects that use PlaceholderRelationField. An active staff user without cms.use_structure or model-level view or change permission can request the //admin/cms/placeholder/object/<content_type_id>/structure/<object_id>/ endpoint with guessed content_type_id and object_id values. The response discloses placeholder slot names, plugin trees, plugin identifiers, labels, and object existence for frontend-editable objects. The fix applies user_can_view_placeholder_source to the non-PageContent branch while keeping the structure board read-only for view-only users.
- CVE-2026-54624Medium
django CMS prior to 5.0.8 has a vulnerability in render_object_structure in cms/views.py that renders cms/toolbar/structure.html for a PageContent object without calling user_can_view_page(). Any staff account can request a restricted page’s structure when CMS_PERMISSION is enabled and the page has view restrictions or CMS_PUBLIC_FOR is set to staff. The response exposes plugin get_short_description() values, including link names, URLs, and text snippets, rather than only the page shape.
- CVE-2026-54622Medium
django CMS before version 5.0.8 has a vulnerability in the copy_plugins endpoint that authorizes only the destination clipboard but does not validate the source placeholder. A staff user with global add permission for a plugin type can copy plugins from unauthorized pages and read secret text, link names, and URLs.
- CVE-2026-54623High
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the move_plugin endpoint in cms/admin/placeholderadmin.py accepts an attacker-controlled plugin_parent value without rejecting a plugin’s own identifier or a descendant identifier. A staff user with plugin-change permission under CMS_PERMISSION can create a parent_id cycle in the plugin tree. The _get_descendants_cte and _get_ancestors_cte queries in cms/models/pluginmodel.py have no cycle guard, so get_descendants() and later rendering, copy, or delete operations can recurse indefinitely or reach a database recursion limit, corrupting the tree and consuming request workers. This issue is fixed in versions 5.0.8.
Original NVD description (English source)
django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request headers declared by plugins through get_vary_cache_on(). The _page_cache_key function includes the cache prefix, site, language, path, and timezone but not the declared header values. Although set_page_cache adds those names to the response Vary header, get_page_cache retrieves the first stored variant under the same header-agnostic key. When CMS_PAGE_CACHE is enabled and a plugin varies content on a header such as Country-Code, one visitor can receive another visitor’s request-specific content, and an unauthenticated attacker can prime the cache with attacker-chosen content. This issue is fixed in versions 5.0.8 and 5.1.0.