CVE-2026-63003— django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)
Quick assessment
Affected
django-cms django-cms
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Django CMS Association django CMS是Django CMS Association组织的一个内容管理系统。 Django CMS Association django CMS 5.0.9之前版本存在授权问题漏洞，该漏洞源于页面复制时缺乏对源页面的对象级授权检查，可能导致特制源值复制未经授权页面中的占位符和插件，从而暴露跨站点或受限子树的内容。
Possible ATT&CK Techniques 1 AI
T1530 · Data from Cloud StorageAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| django-cms | django-cms | < 5.0.9 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-63003
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)
Source: CVE Program / CVE List V5
Vulnerability Description
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, page duplication lacks an object-level authorization check on the source page. In cms/admin/forms.py, DuplicatePageForm.source accepts any Page, the AddPageForm constructor does not narrow a hidden source field, AddPageForm.clean does not validate the source against the user, and AddPageForm.save calls from_source. In cms/admin/pageadmin.py, duplicate and PageAdmin.has_add_permission check only whether a staff user may add a page. A crafted source value can therefore copy every placeholder and plugin from an unauthorized page with permissions=False, stripping source view restrictions and exposing content across sites or restricted subtrees when CMS_PERMISSION is enabled. This issue is fixed in versions 5.0.9.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Vulnerability Title
Django CMS Association django CMS 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Django CMS Association django CMS是Django CMS Association组织的一个内容管理系统。 Django CMS Association django CMS 5.0.9之前版本存在授权问题漏洞，该漏洞源于页面复制时缺乏对源页面的对象级授权检查，可能导致特制源值复制未经授权页面中的占位符和插件，从而暴露跨站点或受限子树的内容。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| django-cms | django-cms | < 5.0.9 | - |
|
II. Public POCs for CVE-2026-63003
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-63003
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-63003 (2)
Vendor Advisories for CVE-2026-63003 (1)
Vendor Pages for CVE-2026-63003 (1)
-
🔗 Release 5.0.9 · django-cms/django-cms · GitHub x_refsource_MISC
Same Patch Batch · django-cms · 2026-08-20 · 7 CVEs total
| CVE-2026-54623 | 7.1 HIGH | django CMS: Plugin move endpoint allows cyclic reparenting (DoS) |
| CVE-2026-54622 | 6.5 MEDIUM | django CMS: Clipboard copy IDOR discloses unauthorized plugin content |
| CVE-2026-54624 | 6.5 MEDIUM | django CMS: Structure endpoint bypasses page-view permission |
| CVE-2026-54625 | 4.8 MEDIUM | django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning) |
| CVE-2026-75526 | 4.4 MEDIUM | django CMS: Stored XSS in edit-mode plugin exception rendering |
| CVE-2026-61663 | 4.3 MEDIUM | django CMS: Missing authorization in `render_object_structure` discloses non-PageContent p |
IV. Related Vulnerabilities
Same product: django-cms
-
CVE-2026-75526
django CMS: Stored XSS in edit-mode plugin exception renderi -
CVE-2026-61663
django CMS: Missing authorization in `render_object_structur -
CVE-2026-54622
django CMS: Clipboard copy IDOR discloses unauthorized plugi -
CVE-2026-54624
django CMS: Structure endpoint bypasses page-view permission -
CVE-2026-54623
django CMS: Plugin move endpoint allows cyclic reparenting (
Same vendor: django-cms
-
CVE-2026-75526
django CMS: Stored XSS in edit-mode plugin exception renderi -
CVE-2026-61663
django CMS: Missing authorization in `render_object_structur -
CVE-2026-54622
django CMS: Clipboard copy IDOR discloses unauthorized plugi -
CVE-2026-54624
django CMS: Structure endpoint bypasses page-view permission -
CVE-2026-54623
django CMS: Plugin move endpoint allows cyclic reparenting (
Same weakness: CWE-639
-
CVE-2026-107856
CiviForm: Trusted-Intermediary IDOR discloses any citizen's -
CVE-2026-107854
Jexactyl: Free-billing order endpoint renews and unsuspends -
CVE-2026-107850
Contao: Improper access control in the preview links module -
CVE-2026-108096
Improper authorization in query resolvers for SQL-backed mod -
CVE-2026-108110
MOVO through 0.2.3 Authorization Bypass via Document Endpoin
V. Comments for CVE-2026-63003
No comments yet