CVE-2026-61663

The render_object_structure view in django CMS (4.0.0–5.0.x) lacked object-level authorization for non-PageContent models using PlaceholderRelationField. An authenticated staff user without cms.use_structure or model-level permissions could request the structure endpoint with guessed IDs to discl...

CVE-2026-61663 django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, renderobjectstructure fails to authorize non-PageContent objects that use PlaceholderRelationField. An active staff user without cms.usestructure or model-level view or chan...