django CMS: Stored XSS in edit-mode plugin exception rendering

Summary When plugin rendering fails in edit mode, django CMS renders a cms-rendering-exception block so editors can see that a placeholder could not be rendered. Older code built that block's heading by interpolating the exception message, placeholder/source strings, and the failing plugin's shor...

GHSA-VGXM-H9GX-H9W7 django CMS: Structure endpoint bypasses page-view permission

Summary The structure-board endpoint renderobjectstructure renders a page's plugin structure without verifying that the requesting user is allowed to view the page. The edit and preview endpoints enforce this via renderpage, but the structure endpoint does not, allowing a low-privileged staff use...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the renderobjectstructure function. An attacker can access sensitive page content by sending requests to the structure endpoint with the content-type id and object id of a view-restricted page. This is only...

django CMS: Structure endpoint bypasses page-view permission

Summary The structure-board endpoint renderobjectstructure renders a page's plugin structure without verifying that the requesting user is allowed to view the page. The edit and preview endpoints enforce this via renderpage, but the structure endpoint does not, allowing a low-privileged staff use...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through the copyplugins admin endpoint when the source-side authorization is not properly checked. An attacker can access unauthorized plugin content by supplying a sourceplaceholderid or...

django CMS: Clipboard copy IDOR discloses unauthorized plugin content

Summary The clipboard copy paths of the copyplugins admin endpoint validate only the target the user's own clipboard and skip source-side authorization. A staff user can copy plugins out of a placeholder they have no permission on into their clipboard, then read the secret content. Details In...

GHSA-4XFR-4P46-GC6P django CMS: Clipboard copy IDOR discloses unauthorized plugin content

Summary The clipboard copy paths of the copyplugins admin endpoint validate only the target the user's own clipboard and skip source-side authorization. A staff user can copy plugins out of a placeholder they have no permission on into their clipboard, then read the secret content. Details In...

EUVD-2026-41146

Wagtail: Denial of service via unbounded filter specs in the image preview...

CVE-2026-54623

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the moveplugin endpoint in cms/admin/placeholderadmin.py accepts an attacker-controlled pluginparent value without rejecting a plugin’s own identifier or a descendant...

CVE-2026-54625

django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request headers declared by plugins through getvarycacheon. The pagecachekey function includes the cache prefix, site, language, path, and timezone bu...

CVE-2026-75526 django CMS: Stored XSS in edit-mode plugin exception rendering

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. From 5.0.8 until 5.0.9, ContentRenderer.renderplaceholder in cms/pluginrendering.py can pass stored, attacker-controlled values to ContentRenderer.renderexception when plugin rendering fail...

CVE-2026-75526 django CMS: Stored XSS in edit-mode plugin exception rendering

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. From 5.0.8 until 5.0.9, ContentRenderer.renderplaceholder in cms/pluginrendering.py can pass stored, attacker-controlled values to ContentRenderer.renderexception when plugin rendering fail...

CVE-2026-75526

django CMS versions 5.0.8 through 5.0.9 contain a stored XSS in the edit-mode plugin exception rendering path. When a plugin raises during rendering, ContentRenderer.render_placeholder in cms/plugin_rendering.py passes attacker-controlled values (from get_short_description(), the exception messag...

EUVD-2026-63571

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. From 5.0.8 until 5.0.9, ContentRenderer.renderplaceholder in cms/pluginrendering.py can pass stored, attacker-controlled values to ContentRenderer.renderexception when plugin rendering fail...

CVE-2026-75526 django CMS: Stored XSS in edit-mode plugin exception rendering

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. From 5.0.8 until 5.0.9, ContentRenderer.renderplaceholder in cms/pluginrendering.py can pass stored, attacker-controlled values to ContentRenderer.renderexception when plugin rendering fail...

EUVD-2026-63570

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, page duplication lacks an object-level authorization check on the source page. In cms/admin/forms.py, DuplicatePageForm.source accepts any Page, the AddPageForm constructor...

CVE-2026-63003 django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, page duplication lacks an object-level authorization check on the source page. In cms/admin/forms.py, DuplicatePageForm.source accepts any Page, the AddPageForm constructor...

CVE-2026-63003 django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, page duplication lacks an object-level authorization check on the source page. In cms/admin/forms.py, DuplicatePageForm.source accepts any Page, the AddPageForm constructor...

CVE-2026-63003

A staff user with only "add page" permission can POST a crafted source page ID to the duplicate endpoint, copying all placeholders/plugins of an unauthorized page and stripping its view restrictions, exposing restricted or cross-site content. The fix adds an object-level user_can_view_page() chec...

CVE-2026-61663 django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, renderobjectstructure fails to authorize non-PageContent objects that use PlaceholderRelationField. An active staff user without cms.usestructure or model-level view or chan...