The vulnerability occurs because the page cache in django CMS ignores plugin‑declared Vary headers. A plugin can advertise that it varies content based on a request header such as Country-Code, but the cache key does not incorporate those header values. As a result, an unauthenticated attacker can prime the cache with attacker‑chosen content and cause other visitors to receive this content. This cache poisoning can lead to information disclosure or display of content that is meant for a different user. The weakness is reflected by CWE‑349 (Untrusted Data Remapping) and CWE‑524 (Large Deviation from the Expected Behavior). The primary impact is to all visitors who hit a cached page that varies by header, allowing an attacker to inject a variant of that page into the cache.

The affected product is django‑CMS (django‑cms). Versions prior to 5.0.8 and the 5.1.0a1 release are vulnerable. The issue is fixed in 5.0.8 and 5.1.0. Users who have CMS_PAGE_CACHE enabled and any plugin that uses get_vary_cache_on() are the ones impacted.

The CVSS score of 4.8 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in CISA's KEV catalog. The attack vector is a simple HTTP request to a cached page, requiring no authentication. Once the vulnerability is exploited, a single unauthenticated attacker can poison the cache and cause other users to see attacker‑chosen content, which is a significant privacy and integrity risk.