Vulnerability · Published Aug 20, 2026 · Assigned by GitHub_M

CVE-2026-61663django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff

Medium 4.3

In plain English

A medium-severity authorization bypass via user-controlled key in django-cms from django-cms. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 72.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, render_object_structure fails to authorize non-PageContent objects that use PlaceholderRelationField. An active staff user without cms.use_structure or model-level view or change permission can request the //admin/cms/placeholder/object/<content_type_id>/structure/<object_id>/ endpoint with guessed content_type_id and object_id values. The response discloses placeholder slot names, plugin trees, plugin identifiers, labels, and object existence for frontend-editable objects. The fix applies user_can_view_placeholder_source to the non-PageContent branch while keeping the structure board read-only for view-only users. This issue is fixed in versions 5.0.9.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	django-cms	5.0.9	GHSA-8qj2-c6q4-f399
PyPI	django-cms	5.0.9	PYSEC-2026-3823

Affected products (as reported)

Vendor	Product	Versions
django-cms	django-cms	< 5.0.9

Weakness: CWE-639, CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/django-cms/django-cms/security/advisories/GHSA-8qj2-c6q4-f399 x_refsource_CONFIRM
https://github.com/django-cms/django-cms/pull/8703 x_refsource_MISC
https://github.com/django-cms/django-cms/commit/9c82abfeb25471583e23906ea1ebef9202527b04 x_refsource_MISC
https://github.com/django-cms/django-cms/releases/tag/5.0.9 x_refsource_MISC