HIGH 7.1 NVD
CVE-2026-93455
django-page-cms through 2.0.13 fails to properly validate page permissions in admin helper views, allowing any staff account to read arbitrary page content and
django-page-cms through 2.0.13 fails to properly validate page permissions in admin helper views, allowing any staff account to read arbitrary page content and stored media paths. Attackers with low-privilege staff credentials can enumerate content identifiers and access unpublished drafts, page listings, and file paths without proper authorization checks.
References
- https://github.com/batiste/django-page-cms
- https://github.com/batiste/django-page-cms/blob/bc4cbe6c187d2d4573289c5695ce8dec0556994d/p
- https://github.com/batiste/django-page-cms/blob/bc4cbe6c187d2d4573289c5695ce8dec0556994d/p
- https://github.com/batiste/django-page-cms/blob/bc4cbe6c187d2d4573289c5695ce8dec0556994d/p
- https://github.com/batiste/django-page-cms/issues/244
This high severity vulnerability with a CVSS score of 7.1 was published on 2026-09-18 via NVD.
vulnfeed aggregates 13481 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.