django CMS: Structure endpoint bypasses page-view permission
Summary
The structure-board endpoint (render_object_structure) renders a page's plugin structure without verifying that the requesting user is allowed to view the page. The edit and preview endpoints enforce this via render_page(), but the structure endpoint does not, allowing a low-privileged staff user to read the plugin structure of a view-restricted page.
Details
render_object_structure (in cms/views.py) loads the PageContent object and renders cms/toolbar/structure.html directly. Unlike render_object_endpoint (used by edit/preview), which renders through render_pagecontent → render_page and calls user_can_view_page(request.user, page) (returning 404 when the user may not view the page), the structure endpoint performs no page-level authorization.
The rendered structure board includes each plugin's get_short_description() (e.g. link names/URLs, text snippets), so the content of a restricted page is disclosed, not just its shape.
Impact
A staff user (any account with is_staff=True) who lacks view permission on a view-restricted page can retrieve that page's plugin structure and short descriptions by requesting the structure endpoint with the page's content-type id and object id.
This only applies when CMS_PERMISSION=True and the page has view restrictions (or CMS_PUBLIC_FOR='staff'). Sites without per-page view restrictions are not affected.
Patches
Fixed in 5.0.8: the structure endpoint now enforces user_can_view_page() for PageContent objects, matching edit/preview.
Workarounds
None other than restricting staff access. Upgrade is recommended.
Credits
Reported by the security team at the University of Sydney ([@reporter]).
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Python (PyPI) | django-cms | < 5.0.8 | 5.0.8 |
Referencias
- https://github.com/django-cms/django-cms/security/advisories/GHSA-vgxm-h9gx-h9w7
- https://github.com/django-cms/django-cms/pull/8645
- https://github.com/django-cms/django-cms/commit/7642a98ab3170793c0b27b4125dd1f3d318b8a1c
- https://github.com/django-cms/django-cms
- https://github.com/django-cms/django-cms/releases/tag/5.0.8
- https://pypi.org/project/django-cms
- https://github.com/advisories/GHSA-vgxm-h9gx-h9w7
- https://nvd.nist.gov/vuln/detail/CVE-2026-54624
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N- Debilidad (CWE)
CWE-285, CWE-862- Plataforma
- Python (PyPI)
- Paquete
django-cms- Publicada
- 20.08.2026
- Actualizado
- 11.10.2026 15:18
Fuentes y licencias
OSV / GitHub Advisory Database - PYSEC-2026-3826 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-vgxm-h9gx-h9w7 - CC BY 4.0
Historial de vulnerabilidades: django-cms
Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 10
- Primera → última
- 08.2017 08.2026
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Alta 2
- Media 8
Divulgaciones por año
- 2017: 1
- 2018: 0
- 2019: 0
- 2020: 0
- 2021: 0
- 2022: 1
- 2023: 0
- 2024: 1
- 2025: 0
- 2026: 7
-
django CMS: Structure endpoint bypasses page-view permission esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.