django-shop (1.2.4), djangocms-algolia (>=0.1.0.0, <=1.3.2.0) +8 more potentially affected by CVE-2026-54624 via django-cms (3.11.3)

django-cms PYPI version 3.11.3 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - django-shop 1.2.4 - djangocms-algolia =0.1.0.0, =1.0.0, =1.0.0, =0.2.0.0, =0.0.0.1, =1.0.0.0 - djangoshop-gestpay 0.1.0 - djangoshop-wspay...

cmsplugin-blocks (>=1.3.0, <=1.5.3), cmsplugin-css-background (>=0.1.0, <=0.2.0) +36 more potentially affected by CVE-2026-54624 via django-cms (3.11.11)

django-cms PYPI version 3.11.11 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - cmsplugin-blocks =1.3.0, =0.1.0, =0.0.3, =2.0.0, =3.6.2, =7.0.4, =1.3.3.0, =0.6.0a3, =0.2.0, =0.0.2, =0.1.0, =0.3.0 and more Source cves:...

djangocms-lab-carousel (0.2.1), djangocms-shiny-app (0.1.3) potentially affected by CVE-2026-54624 via django-cms (3.1.7)

django-cms PYPI version 3.1.7 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - djangocms-lab-carousel 0.2.1 - djangocms-shiny-app 0.1.3 Source cves: CVE-2026-54624 Source advisory: OSV:GHSA-VGXM-H9GX-H9W7...

aldryn-faq (1.0.13), aldryn-people (1.1.1) +1 more potentially affected by CVE-2026-54624 via django-cms (3.2.5)

django-cms PYPI version 3.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - aldryn-faq 1.0.13 - aldryn-people 1.1.1 - aldryn-snippet 0.1.4.2 Source cves: CVE-2026-54624 Source advisory: OSV:GHSA-VGXM-H9GX-H9W7...

djangocms-highlightjs (0.4.0), djangocms-lab-publications (0.1.4) potentially affected by CVE-2026-54624 via django-cms (3.3.1)

django-cms PYPI version 3.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - djangocms-highlightjs 0.4.0 - djangocms-lab-publications 0.1.4 Source cves: CVE-2026-54624 Source advisory: OSV:GHSA-VGXM-H9GX-H9W7...

cmsplugin-articles-ai (>=0.1.2, <=0.2.4), cmsplugin-google-maps-ai (0.0.1) +3 more potentially affected by CVE-2026-54624 via django-cms (3.4.7)

django-cms PYPI version 3.4.7 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - cmsplugin-articles-ai =0.1.2, =0.0.3, =0.4.0 - djangocms-htmlsitemap 0.3.1 - djangocms-slick-slider 0.6.0 Source cves: CVE-2026-54624 Source...

django-cms-qe (1.4.3), django-oscar-moysklad (>=0.2.4, <=0.2.5) +1 more potentially affected by CVE-2026-54624 via django-cms (3.5.2)

django-cms PYPI version 3.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - django-cms-qe 1.4.3 - django-oscar-moysklad =0.2.4, =0.2.5 - richie 0.1.0 Source cves: CVE-2026-54624 Source advisory: OSV:GHSA-VGXM-H9GX-H9...

aldryn-django-cms (3.5.3.2), django-shopit (0.5.2) potentially affected by CVE-2026-54624 via django-cms (3.5.3)

django-cms PYPI version 3.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - aldryn-django-cms 3.5.3.2 - django-shopit 0.5.2 Source cves: CVE-2026-54624 Source advisory: OSV:GHSA-VGXM-H9GX-H9W7...

aldryn-events (2.0.0), aldryn-people (2.0.0) +7 more potentially affected by CVE-2026-54624 via django-cms (3.5.4)

django-cms PYPI version 3.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - aldryn-events 2.0.0 - aldryn-people 2.0.0 - aldryn-reversion =1.0.7, =0.2.0, =0.6.2, =0.3.0, =0.3.5 - emencia-contact-form 0.3.0 Source cves...

django-cms-forms (>=0.0.1, <=0.0.11) potentially affected by CVE-2026-54624 via django-cms (3.7.1)

django-cms PYPI version 3.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - django-cms-forms =0.0.1, =0.0.11 Source cves: CVE-2026-54624 Source advisory: OSV:GHSA-VGXM-H9GX-H9W7...

aldryn-forms (>=3.0.4, <=3.0.5), django-cms-qe (>=2.0.0, <=2.2.0) +5 more potentially affected by CVE-2026-54624 via django-cms (3.7.4)

django-cms PYPI version 3.7.4 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - aldryn-forms =3.0.4, =2.0.0, =0.1.0, =0.1.0, =0.2.4 - taccsite-cms 3.6.0a0 Source cves: CVE-2026-54624 Source advisory: OSV:GHSA-VGXM-H9GX-H...

django-unfold-extra (>=0.1.1, <=0.1.2), djangocms-haystack (>=0.5.0, <=0.5.1) potentially affected by CVE-2026-54624 via django-cms (>=5.0.0a1, <=5.0.6)

django-cms PYPI version =5.0.0a1, =0.1.1, =0.5.0, =0.5.1 Source cves: CVE-2026-54624 Source advisory: SNYK:PYTHON-DJANGOCMS-19432276...

richie (>=1.0.0b0, <=1.0.0b3) potentially affected by CVE-2026-54624 via django-cms (3.6.0)

django-cms PYPI version 3.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - richie =1.0.0b0, =1.0.0b3 Source cves: CVE-2026-54624 Source advisory: OSV:GHSA-VGXM-H9GX-H9W7...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the renderobjectstructure function. An attacker can access sensitive page content by sending requests to the structure endpoint with the content-type id and object id of a view-restricted page. This is only...

cmsplugin-markdownx (0.1.2) potentially affected by CVE-2026-54624 via django-cms (3.4.2)

django-cms PYPI version 3.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - cmsplugin-markdownx 0.1.2 Source cves: CVE-2026-54624 Source advisory: OSV:GHSA-VGXM-H9GX-H9W7...

djangocms-htmlsitemap (0.5.0), leprikon (>=2.28.1, <=2.39.2) potentially affected by CVE-2026-54624 via django-cms (3.6.1)

django-cms PYPI version 3.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - djangocms-htmlsitemap 0.5.0 - leprikon =2.28.1, =2.39.2 Source cves: CVE-2026-54624 Source advisory: OSV:GHSA-VGXM-H9GX-H9W7...

richie (2.15.1) potentially affected by CVE-2026-54624 via django-cms (3.11.0)

django-cms PYPI version 3.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - richie 2.15.1 Source cves: CVE-2026-54624 Source advisory: OSV:GHSA-VGXM-H9GX-H9W7...

django-cms-helpers (3.0.0), djangocms-aldryn-forms (>=8.0.0, <=8.2.0) +10 more potentially affected by CVE-2026-54624 via django-cms (4.1.11)

django-cms PYPI version 4.1.11 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - django-cms-helpers 3.0.0 - djangocms-aldryn-forms =8.0.0, =4.0.0, =3.0.0, =2.0.0, =2.0.0, =0.2.2, =0.5.0, =1.1.4, =1.1.8 Source cves:...

django-unfold-extra (>=0.1.1, <=0.1.2), djangocms-haystack (>=0.5.0, <=0.5.1) potentially affected by CVE-2026-54624 via django-cms (>=5.0.0a1, <=5.0.6)

django-cms PYPI version =5.0.0a1, =0.1.1, =0.5.0, =0.5.1 Source cves: CVE-2026-54624 Source advisory: OSV:GHSA-VGXM-H9GX-H9W7...

GHSA-VGXM-H9GX-H9W7 django CMS: Structure endpoint bypasses page-view permission

Summary The structure-board endpoint renderobjectstructure renders a page's plugin structure without verifying that the requesting user is allowed to view the page. The edit and preview endpoints enforce this via renderpage, but the structure endpoint does not, allowing a low-privileged staff use...