djangocms-plugie (0.1.4) potentially affected by CVE-2026-54622 via django-cms (3.7.0rc2)

django-cms PYPI version 3.7.0rc2 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - djangocms-plugie 0.1.4 Source cves: CVE-2026-54622 Source advisory: OSV:PYSEC-2026-3820...

django-cms-qe (1.4.3), django-oscar-moysklad (>=0.2.4, <=0.2.5) +1 more potentially affected by CVE-2026-54622 via django-cms (3.5.2)

django-cms PYPI version 3.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - django-cms-qe 1.4.3 - django-oscar-moysklad =0.2.4, =0.2.5 - richie 0.1.0 Source cves: CVE-2026-54622 Source advisory: OSV:PYSEC-2026-3820...

django-cms-helpers (3.0.0), djangocms-aldryn-forms (>=8.0.0, <=8.2.0) +10 more potentially affected by CVE-2026-54622 via django-cms (4.1.11)

django-cms PYPI version 4.1.11 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - django-cms-helpers 3.0.0 - djangocms-aldryn-forms =8.0.0, =4.0.0, =3.0.0, =2.0.0, =2.0.0, =0.2.2, =0.5.0, =1.1.4, =1.1.8 Source cves:...

cmsplugin-blocks (>=1.3.0, <=1.5.3), cmsplugin-css-background (>=0.1.0, <=0.2.0) +36 more potentially affected by CVE-2026-54622 via django-cms (3.11.11)

django-cms PYPI version 3.11.11 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - cmsplugin-blocks =1.3.0, =0.1.0, =0.0.3, =2.0.0, =3.6.2, =7.0.4, =1.3.3.0, =0.6.0a3, =0.2.0, =0.0.2, =0.1.0, =0.3.0 and more Source cves:...

django-shop (1.2.4), djangocms-algolia (>=0.1.0.0, <=1.3.2.0) +8 more potentially affected by CVE-2026-54622 via django-cms (3.11.3)

django-cms PYPI version 3.11.3 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - django-shop 1.2.4 - djangocms-algolia =0.1.0.0, =1.0.0, =1.0.0, =0.2.0.0, =0.0.0.1, =1.0.0.0 - djangoshop-gestpay 0.1.0 - djangoshop-wspay...

aldryn-events (2.0.0), aldryn-people (2.0.0) +7 more potentially affected by CVE-2026-54622 via django-cms (3.5.4)

django-cms PYPI version 3.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - aldryn-events 2.0.0 - aldryn-people 2.0.0 - aldryn-reversion =1.0.7, =0.2.0, =0.6.2, =0.3.0, =0.3.5 - emencia-contact-form 0.3.0 Source cves...

aldryn-forms (>=3.0.4, <=3.0.5), django-cms-qe (>=2.0.0, <=2.2.0) +5 more potentially affected by CVE-2026-54622 via django-cms (3.7.4)

django-cms PYPI version 3.7.4 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - aldryn-forms =3.0.4, =2.0.0, =0.1.0, =0.1.0, =0.2.4 - taccsite-cms 3.6.0a0 Source cves: CVE-2026-54622 Source advisory: OSV:PYSEC-2026-3820...

django-cms-forms (>=0.0.1, <=0.0.11) potentially affected by CVE-2026-54622 via django-cms (3.7.1)

django-cms PYPI version 3.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - django-cms-forms =0.0.1, =0.0.11 Source cves: CVE-2026-54622 Source advisory: OSV:PYSEC-2026-3820...

django-unfold-extra (>=0.1.1, <=0.1.2), djangocms-haystack (>=0.5.0, <=0.5.1) potentially affected by CVE-2026-54622 via django-cms (>=5.0.0a1, <=5.0.6)

django-cms PYPI version =5.0.0a1, =0.1.1, =0.5.0, =0.5.1 Source cves: CVE-2026-54622 Source advisory: GHSA-4XFR-4P46-GC6P...

django-cms-helpers (3.0.0), djangocms-aldryn-forms (>=8.0.0, <=8.2.0) +10 more potentially affected by CVE-2026-54622 via django-cms (4.1.11)

django-cms PYPI version 4.1.11 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - django-cms-helpers 3.0.0 - djangocms-aldryn-forms =8.0.0, =4.0.0, =3.0.0, =2.0.0, =2.0.0, =0.2.2, =0.5.0, =1.1.4, =1.1.8 Source cves:...

django-cms-forms (>=0.0.1, <=0.0.11) potentially affected by CVE-2026-54622 via django-cms (3.7.1)

django-cms PYPI version 3.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - django-cms-forms =0.0.1, =0.0.11 Source cves: CVE-2026-54622 Source advisory: OSV:GHSA-4XFR-4P46-GC6P...

richie (>=1.0.0b0, <=1.0.0b3) potentially affected by CVE-2026-54622 via django-cms (3.6.0)

django-cms PYPI version 3.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - richie =1.0.0b0, =1.0.0b3 Source cves: CVE-2026-54622 Source advisory: OSV:GHSA-4XFR-4P46-GC6P...

aldryn-events (2.0.0), aldryn-people (2.0.0) +7 more potentially affected by CVE-2026-54622 via django-cms (3.5.4)

django-cms PYPI version 3.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - aldryn-events 2.0.0 - aldryn-people 2.0.0 - aldryn-reversion =1.0.7, =0.2.0, =0.6.2, =0.3.0, =0.3.5 - emencia-contact-form 0.3.0 Source cves...

cmsplugin-markdownx (0.1.2) potentially affected by CVE-2026-54622 via django-cms (3.4.2)

django-cms PYPI version 3.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - cmsplugin-markdownx 0.1.2 Source cves: CVE-2026-54622 Source advisory: OSV:GHSA-4XFR-4P46-GC6P...

aldryn-faq (1.0.13), aldryn-people (1.1.1) +1 more potentially affected by CVE-2026-54622 via django-cms (3.2.5)

django-cms PYPI version 3.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - aldryn-faq 1.0.13 - aldryn-people 1.1.1 - aldryn-snippet 0.1.4.2 Source cves: CVE-2026-54622 Source advisory: OSV:GHSA-4XFR-4P46-GC6P...

CVE-2026-54622 django CMS: Clipboard copy IDOR discloses unauthorized plugin content

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the copyplugins endpoint in cms/admin/placeholderadmin.py authorizes only the destination clipboard. The copyplugintoclipboard and copyplaceholdertoclipboard paths accept...

aldryn-django-cms (3.5.3.2), aldryn-events (>=1.1.1, <=2.0.0) +79 more potentially affected by CVE-2026-54622 via django-cms (>=3.1.7, <=5.0.6)

django-cms PYPI version =3.1.7, =1.1.1, =1.0.13, =3.0.4, =1.1.1, =1.0.7, =0.2.0, =0.1.1, =1.3.0, =0.1.0, =0.2.0 - cmsplugin-feed-ai 0.0.1 - cmsplugin-google-maps-ai 0.0.1 - cmsplugin-markdownx 0.1.2 and more Source cves: CVE-2026-54622 Source advisory: MEND:CVE-2026-54622...

CVE-2026-54622

django CMS prior to 5.0.8 contains an IDOR in the copy_plugins admin endpoint (cms/admin/placeholderadmin.py). The _copy_plugin_to_clipboard and _copy_placeholder_to_clipboard paths validate only the destination clipboard but never perform source-side authorization on the attacker-supplied source...