PYSEC-2026-3822 django CMS: Plugin move endpoint allows cyclic reparenting (DoS)

Summary The moveplugin admin endpoint does not prevent a plugin from being reparented under itself or one of its own descendants. Doing so creates a cycle in the plugin tree, after which the recursive descendant/ancestor SQL queries loop without terminating, stalling the request worker. Details...

EUVD-2026-63565

django CMS: Plugin move endpoint allows cyclic reparenting DoS...

GHSA-8JJ7-4V57-FRF5 django CMS: Plugin move endpoint allows cyclic reparenting (DoS)

Summary The moveplugin admin endpoint does not prevent a plugin from being reparented under itself or one of its own descendants. Doing so creates a cycle in the plugin tree, after which the recursive descendant/ancestor SQL queries loop without terminating, stalling the request worker. Details...

CVE-2026-54623 django CMS: Plugin move endpoint allows cyclic reparenting (DoS)

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the moveplugin endpoint in cms/admin/placeholderadmin.py accepts an attacker-controlled pluginparent value without rejecting a plugin’s own identifier or a descendant...

CVE-2026-54623 django CMS: Plugin move endpoint allows cyclic reparenting (DoS)

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the moveplugin endpoint in cms/admin/placeholderadmin.py accepts an attacker-controlled pluginparent value without rejecting a plugin’s own identifier or a descendant...

CVE-2026-54623

django CMS prior to 5.0.8 is vulnerable to a denial-of-service via the move_plugin endpoint in cms/admin/placeholderadmin.py. The endpoint accepts an attacker-controlled plugin_parent value without rejecting a plugin's own identifier or a descendant identifier, allowing a staff user with plugin-c...

PT-2026-79091

Name of the Vulnerable Software and Affected Versions django CMS versions prior to 5.0.8 Description The 'move plugin' endpoint in 'cms/admin/placeholderadmin.py' fails to validate the plugin parent value, allowing a staff user with plugin-change permissions to assign a plugin's own identifier or...