A vulnerability in django CMS's render_object_structure function allows an authenticated staff user lacking appropriate permissions to request the /admin/cms/placeholder/object/<content_type_id>/structure/<object_id>/ endpoint with guessed identifiers. The response exposes placeholder slot names, plugin trees, plugin identifiers, labels, and object existence for frontend‑editable objects, effectively leaking internal structure. This unauthorized disclosure, identified as CWE-639 and CWE-862, can compromise confidentiality by revealing application architecture to low‑privileged staff.

The issue affects installations of django CMS older than version 5.0.9. Users running any django CMS release prior to 5.0.9 are susceptible. Versions 5.0.9 and later include the fix that applies user_can_view_placeholder_source to the non‑PageContent branch and restricts the structure board to view‑only access for read‑only users.

The CVSS score of 4.3 indicates moderate severity, largely due to the limited audience – only staff users within the admin interface. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to guess valid content_type_id and object_id values, which may be feasible by enumeration or observing application traffic. Because the disclosure is limited to non‑PageContent placeholder structure, the impact is primarily informational rather than destructive.