CVSS 3.1
Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)
Атакува се
Време до експлоатация
Атакува се по мрежата, без особени условия, с обикновен потребителски вход и без действие от потребителя.
- Експлоатация: има публичен пример за експлоатация
- Атаката не може да се автоматизира
Описание
Оригинално описание
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, render_object_structure fails to authorize non-PageContent objects that use PlaceholderRelationField. An active staff user without cms.use_structure or model-level view or change permission can request the //admin/cms/placeholder/object/<content_type_id>/structure/<object_id>/ endpoint with guessed content_type_id and object_id values. The response discloses placeholder slot names, plugin trees, plugin identifiers, labels, and object existence for frontend-editable objects. The fix applies user_can_view_placeholder_source to the non-PageContent branch while keeping the structure board read-only for view-only users. This issue is fixed in versions 5.0.9.
Засегнати продукти
- django-cms django-cms: < 5.0.9
Вид слабост
История
- 20 август 2026 Публикувано
Други уязвимости в django-cms django-cms
Първоизточници
- https://www.cve.org/CVERecord?id=CVE-2026-61663
- https://nvd.nist.gov/vuln/detail/CVE-2026-61663
- https://github.com/django-cms/django-cms/security/advisories/GHSA-8qj2-c6q4-f399
- https://github.com/django-cms/django-cms/pull/8703
- https://github.com/django-cms/django-cms/commit/9c82abfeb25471583e23906ea1ebef9202527b04
- https://github.com/django-cms/django-cms/releases/tag/5.0.9