Vulnerability · Published Sep 18, 2026 · Assigned by VulnCheck

CVE-2026-93455django-page-cms through 2.0.13 Unauthorized Content Access via Staff Account

Medium 6.5

In plain English

A medium-severity missing authorization in django-page-cms from batiste. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.5%top 60.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

django-page-cms through 2.0.13 fails to properly validate page permissions in admin helper views, allowing any staff account to read arbitrary page content and stored media paths. Attackers with low-privilege staff credentials can enumerate content identifiers and access unpublished drafts, page listings, and file paths without proper authorization checks.

Affected products (as reported)

Vendor	Product	Versions
batiste	django-page-cms	0 – through 2.0.13

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

GitHub Issue #244 issue-tracking
https://github.com/batiste/django-page-cms product
get_content() resolves Content by content_id alone, ignoring page_id, behind @staff_member_required only technical-description
get_media_url() returns any stored media path by media_id behind @staff_member_required only technical-description
list_pages_ajax() renders the full page listing behind @staff_member_required with no has_perm('pages.change_page') gate, as do get_last_content (L121), traduction (L156) and sub_menu (L210) technical-description
VulnCheck Advisory: django-page-cms through 2.0.13 Unauthorized Content Access via Staff Account third-party-advisory