Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-63003— django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)

Quick assessment

Affected
django-cms django-cms
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

django CMS 是一个易用且对开发者友好的企业内容管理系统，由 Django 驱动。在 5.0.9 版本之前，页面复制功能缺少对源页面的对象级授权检查。在 中， 接受任何 Page 对象， 构造函数未对隐藏的 source 字段进行限制， 方法未验证 source 字段与当前用户之间的权限关系，并且 调用了 。在 中， 方法和 仅检查工作人员用户是否可以添加页面。因此，通过构造特定的 source 值，攻击者可以复制来自权限设置为 False 的未授权页面的所有占位符和插件，从而绕过源页面的查看限制，在启用

CVSS 6.5 · Medium EPSS 0.24% · P15

Possible ATT&CK Techniques 1 AI

T1530 · Data from Cloud Storage

Affected Version Matrix 1

VendorProduct Version RangeStatus
django-cms django-cms < 5.0.9 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-63003

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)
Source: CVE Program / CVE List V5
Vulnerability Description
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, page duplication lacks an object-level authorization check on the source page. In cms/admin/forms.py, DuplicatePageForm.source accepts any Page, the AddPageForm constructor does not narrow a hidden source field, AddPageForm.clean does not validate the source against the user, and AddPageForm.save calls from_source. In cms/admin/pageadmin.py, duplicate and PageAdmin.has_add_permission check only whether a staff user may add a page. A crafted source value can therefore copy every placeholder and plugin from an unauthorized page with permissions=False, stripping source view restrictions and exposing content across sites or restricted subtrees when CMS_PERMISSION is enabled. This issue is fixed in versions 5.0.9.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
django-cms django-cms < 5.0.9 -

II. Public POCs for CVE-2026-63003

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-63003

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-63003 (2)

Vendor Advisories for CVE-2026-63003 (1)

Vendor Pages for CVE-2026-63003 (1)

Same Patch Batch · django-cms · 2026-08-20 · 7 CVEs total

CVE-2026-54623 7.1 HIGH django CMS: Plugin move endpoint allows cyclic reparenting (DoS)
CVE-2026-54622 6.5 MEDIUM django CMS: Clipboard copy IDOR discloses unauthorized plugin content
CVE-2026-54624 6.5 MEDIUM django CMS: Structure endpoint bypasses page-view permission
CVE-2026-54625 4.8 MEDIUM django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)
CVE-2026-75526 4.4 MEDIUM django CMS: Stored XSS in edit-mode plugin exception rendering
CVE-2026-61663 4.3 MEDIUM django CMS: Missing authorization in `render_object_structure` discloses non-PageContent p

IV. Related Vulnerabilities

Same product: django-cms
Same vendor: django-cms
Same weakness: CWE-639

V. Comments for CVE-2026-63003

No comments yet

Leave a comment