CVE-2026-54622

django CMS prior to 5.0.8 contains an IDOR in the copy_plugins admin endpoint (cms/admin/placeholderadmin.py). The _copy_plugin_to_clipboard and _copy_placeholder_to_clipboard paths validate only the destination clipboard but never perform source-side authorization on the attacker-supplied source...