Vulnerability · Published Aug 20, 2026 · Assigned by GitHub_M
CVE-2026-54622django CMS: Clipboard copy IDOR discloses unauthorized plugin content
Medium 6.5
In plain English
A medium-severity authorization bypass via user-controlled key in django-cms from django-cms. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the copy_plugins endpoint in cms/admin/placeholderadmin.py authorizes only the destination clipboard. The _copy_plugin_to_clipboard and _copy_placeholder_to_clipboard paths accept source_placeholder_id and source_plugin_id values but use has_copy_plugins_permission and check_source only for the requesting user’s clipboard, without validating the source placeholder. Under CMS_PERMISSION, a staff user with the global add permission for a plugin type can copy plugins from an unauthorized page or placeholder into the user’s clipboard and read secret text, link names, and URLs. This issue is fixed in versions 5.0.8.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | django-cms | 5.0.8 | GHSA-4xfr-4p46-gc6p |
| PyPI | django-cms | 5.0.8 | PYSEC-2026-3820 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| django-cms | django-cms | < 5.0.8 |
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
- https://github.com/django-cms/django-cms/security/advisories/GHSA-4xfr-4p46-gc6p x_refsource_CONFIRM
- https://github.com/django-cms/django-cms/pull/8645 x_refsource_MISC
- https://github.com/django-cms/django-cms/commit/7642a98ab3170793c0b27b4125dd1f3d318b8a1c x_refsource_MISC
- https://github.com/django-cms/django-cms/releases/tag/5.0.8 x_refsource_MISC