The vulnerability arises because the page duplication feature in django‑CMS does not perform an object‑level authorization check on the source page. A staff user who can add pages can therefore submit a duplicate request containing an arbitrary Page ID that the user is not normally allowed to view. The system accepts the request, copies every placeholder and plugin from the source page, and strips any view restrictions that were originally in place. This allows the attacker to read the content of any page, even across site boundaries or within restricted subtrees when the CMS_PERMISSION setting is enabled, thereby compromising confidentiality and potentially exposing sensitive information.

The flaw affects django‑CMS versions prior to 5.0.9. The security issue was remedied in release 5.0.9 and all subsequent versions.

The CVSS score of 6.5 assigns a moderate to high severity to the issue. No EPSS data is available, but the necessity of only a staff‑level account means the attack is likely feasible in most installations that grant staff users page‑addition rights. Because the flaw is not listed in CISA KEV, it may not yet have widespread exploitation, yet its impact on confidentiality is significant. The attack vector is an authenticated request to the page‑duplicate endpoint with a crafted source parameter. The lack of source validation allows exploitation without additional privileges beyond those of a staff account.