The vulnerability lies in django CMS's copy_plugins endpoint, which only authorizes the destination clipboard and neglects to verify the source placeholder or plugin. A staff user with global add permission for the relevant plugin type can exploit this flaw to copy plugins from any unauthorized page or placeholder. The copied data can reveal secret text, link names, and URLs that were not intended for that user, thereby exposing sensitive content and information.

All installations of django CMS older than version 5.0.8 are impacted. The issue is present in the copy_plugins paths in cms/admin/placeholderadmin.py and is fixed in release 5.0.8. Users should identify whether their deployment is running a vulnerable version and plan for an upgrade.

With a CVSS base score of 6.5, the vulnerability poses a moderate risk. An attacker must be an authenticated staff member with the global add permission for the affected plugin type, making the attack path internal. Although EPSS is not available, the lack of presence in the CISA KEV catalog indicates no widespread exploitation reports known. The protection relies on appropriate permission management; however, the flaw allows unauthorized data disclosure if trust boundaries are breached.