CVE-2026-54625— django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)
Quick assessment
Affected
django-cms django-cms
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Django CMS Association django CMS是Django CMS Association组织的一个内容管理系统。 Django CMS Association django CMS 5.0.8之前版本和5.1.0a1至5.1.0之前版本存在安全漏洞，该漏洞源于页面缓存功能忽略插件声明的请求头部，可能导致用户收到其他用户的特定内容，且未认证攻击者可利用缓存投毒。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| django-cms | django-cms | < 5.0.8 |
affected |
>= 5.1.0a1, < 5.1.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-54625
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)
Source: CVE Program / CVE List V5
Vulnerability Description
django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request headers declared by plugins through get_vary_cache_on(). The _page_cache_key function includes the cache prefix, site, language, path, and timezone but not the declared header values. Although set_page_cache adds those names to the response Vary header, get_page_cache retrieves the first stored variant under the same header-agnostic key. When CMS_PAGE_CACHE is enabled and a plugin varies content on a header such as Country-Code, one visitor can receive another visitor’s request-specific content, and an unauthenticated attacker can prime the cache with attacker-chosen content. This issue is fixed in versions 5.0.8 and 5.1.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在可信数据中接受外来的不可信数据
Source: CVE Program / CVE List V5
Vulnerability Title
Django CMS Association django CMS 信任管理问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Django CMS Association django CMS是Django CMS Association组织的一个内容管理系统。 Django CMS Association django CMS 5.0.8之前版本和5.1.0a1至5.1.0之前版本存在安全漏洞，该漏洞源于页面缓存功能忽略插件声明的请求头部，可能导致用户收到其他用户的特定内容，且未认证攻击者可利用缓存投毒。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| django-cms | django-cms | < 5.0.8 | - |
|
II. Public POCs for CVE-2026-54625
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-54625
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-54625 (4)
Vendor Advisories for CVE-2026-54625 (1)
Same Patch Batch · django-cms · 2026-08-20 · 7 CVEs total
| CVE-2026-54623 | 7.1 HIGH | django CMS: Plugin move endpoint allows cyclic reparenting (DoS) |
| CVE-2026-54622 | 6.5 MEDIUM | django CMS: Clipboard copy IDOR discloses unauthorized plugin content |
| CVE-2026-54624 | 6.5 MEDIUM | django CMS: Structure endpoint bypasses page-view permission |
| CVE-2026-63003 | 6.5 MEDIUM | django CMS: Broken access control in page *Duplicate* allows reading the content of any pa |
| CVE-2026-75526 | 4.4 MEDIUM | django CMS: Stored XSS in edit-mode plugin exception rendering |
| CVE-2026-61663 | 4.3 MEDIUM | django CMS: Missing authorization in `render_object_structure` discloses non-PageContent p |
IV. Related Vulnerabilities
Same product: django-cms
-
CVE-2026-75526
django CMS: Stored XSS in edit-mode plugin exception renderi -
CVE-2026-63003
django CMS: Broken access control in page *Duplicate* allows -
CVE-2026-61663
django CMS: Missing authorization in `render_object_structur -
CVE-2026-54622
django CMS: Clipboard copy IDOR discloses unauthorized plugi -
CVE-2026-54624
django CMS: Structure endpoint bypasses page-view permission
Same vendor: django-cms
-
CVE-2026-75526
django CMS: Stored XSS in edit-mode plugin exception renderi -
CVE-2026-63003
django CMS: Broken access control in page *Duplicate* allows -
CVE-2026-61663
django CMS: Missing authorization in `render_object_structur -
CVE-2026-54622
django CMS: Clipboard copy IDOR discloses unauthorized plugi -
CVE-2026-54624
django CMS: Structure endpoint bypasses page-view permission
Same weakness: CWE-349
-
CVE-2026-48100
Payy: agg_agg trailing message slots are unconstrained and a -
CVE-2026-19033
Unauthenticated IXFR deltas are applied to the live zone bef -
CVE-2026-78301
Out-of-zone database nodes can become authoritative zone cut -
CVE-2026-15387
Acceptance of Extraneous Untrusted Data With Trusted Data in -
CVE-2026-50252
Possible cache poisoning attack by mapping source port popul
V. Comments for CVE-2026-54625
No comments yet