MEDIUM 4.3 NVD
CVE-2026-61663
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, render_object_structure fails to aut
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, render_object_structure fails to authorize non-PageContent objects that use PlaceholderRelationField. An active staff user without cms.use_structure or model-level view or change permission can request the //admin/cms/placeholder/object/<content_type_id>/structure/<object_id>/ endpoint with guessed content_type_id and object_id values. The response discloses placeholder slot names, plugin trees, plugin identifiers, labels, and object existence for frontend-editable objects. The fix applies user_can_view_placeholder_source to the non-PageContent branch while keeping the structure board read-only for view-only users. This issue is fixed in versions 5.0.9.
References
- https://github.com/django-cms/django-cms/commit/9c82abfeb25471583e23906ea1ebef9202527b04
- https://github.com/django-cms/django-cms/pull/8703
- https://github.com/django-cms/django-cms/releases/tag/5.0.9
- https://github.com/django-cms/django-cms/security/advisories/GHSA-8qj2-c6q4-f399
This medium severity vulnerability with a CVSS score of 4.3 was published on 2026-08-20 via NVD.
vulnfeed aggregates 11796 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.