Description
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, render_object_structure in cms/views.py renders cms/toolbar/structure.html for a PageContent object without calling user_can_view_page(). Any staff account can request a restricted page’s structure when CMS_PERMISSION is enabled and the page has view restrictions or CMS_PUBLIC_FOR is set to staff. The response exposes plugin get_short_description() values, including link names, URLs, and text snippets, rather than only the page shape. This issue is fixed in versions 5.0.8.
Published: 2026-08-20
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A staff account can request the structure of a restricted page through the render_object_structure endpoint, which bypasses the user_can_view_page() permission check and returns plugin descriptions, link names, URLs, and text snippets, thereby exposing sensitive content to users with staff privileges.

Affected Systems

The vulnerability affects any installation of django CMS version earlier than 5.0.8 when CMS_PERMISSION is enabled and the page has view restrictions or CMS_PUBLIC_FOR is set to staff.

Risk and Exploitability

The issue has a CVSS score of 6.5, indicating moderate severity, the EPSS score is not available, and it is not listed in CISA KEV. Exploitation requires a valid staff account; thus the attack vector is an authenticated privileged user with staff privileges who can access the structure endpoint. While the risk is moderate, any staff compromise could lead to unintentional disclosure of navigation elements and content snippets.

Generated by OpenCVE AI on August 21, 2026 at 01:40 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade django CMS to version 5.0.8 or later, which includes the fixed permission check in render_object_structure.
  • If an upgrade is not immediately possible, block staff users from accessing the /structure API endpoint until the patch is applied.
  • Alternatively, disable CMS_PERMISSION or set CMS_PUBLIC_FOR to "anonymous" to prevent staff from retrieving restricted page structures until a patch is available.

Generated by OpenCVE AI on August 21, 2026 at 01:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-vgxm-h9gx-h9w7 django CMS: Structure endpoint bypasses page-view permission
History

Thu, 20 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 20 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
First Time appeared Django-cms
Django-cms django Cms
Vendors & Products Django-cms
Django-cms django Cms

Thu, 20 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Description django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, render_object_structure in cms/views.py renders cms/toolbar/structure.html for a PageContent object without calling user_can_view_page(). Any staff account can request a restricted page’s structure when CMS_PERMISSION is enabled and the page has view restrictions or CMS_PUBLIC_FOR is set to staff. The response exposes plugin get_short_description() values, including link names, URLs, and text snippets, rather than only the page shape. This issue is fixed in versions 5.0.8.
Title django CMS: Structure endpoint bypasses page-view permission
Weaknesses CWE-285
CWE-862
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Django-cms Django Cms
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-20T19:46:10.950Z

Reserved: 2026-06-15T20:07:02.185Z

Link: CVE-2026-54624

cve-icon Vulnrichment

Updated: 2026-08-20T19:46:07.459Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-20T19:16:55.583

Modified: 2026-09-09T21:19:49.197

Link: CVE-2026-54624

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T01:45:08Z

Weaknesses