CVE-2026-93455

MediumCVSS 6.5

Published: 18/09/2026(UTC)Updated: 22/09/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

18th percentile - higher than 18% of all known CVEs

Summary

django-page-cms through version 2.0.13 fails to properly validate page permissions in admin helper views, allowing any staff account to read arbitrary page content and stored media paths. Attackers with low-privilege staff credentials can enumerate content identifiers and access unpublished drafts, page listings, and file paths without proper authorization checks.

Risk Assessment

Users with basic staff privileges can access unpublished content and internal file paths, resulting in information disclosure. This may expose data that was not intended for public or broad internal visibility.

Recommendation

Upgrade django-page-cms beyond version 2.0.13 or apply the vendor patch. Additionally, review and restrict staff account permissions to the minimum necessary.

Other vulnerabilities in django-page-cms

CVE-2026-93456High
django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection in pages/admin/views.py, allowing attackers to forge requests that modify page content. Signed-in editors visiting a malicious page can be tricked into storing unescaped content that renders to all visitors, enabling stored cross-site scripting attacks.

Original NVD description (English source)

django-page-cms through 2.0.13 fails to properly validate page permissions in admin helper views, allowing any staff account to read arbitrary page content and stored media paths. Attackers with low-privilege staff credentials can enumerate content identifiers and access unpublished drafts, page listings, and file paths without proper authorization checks.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS