CVE-2026-54625

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-54625
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54625.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-54625
Aliases
Published
2026-08-20T17:58:03.255Z
Modified
2026-08-22T03:58:06.563272417Z
Severity
  • 4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)
Details

django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request headers declared by plugins through getvarycacheon(). The pagecachekey function includes the cache prefix, site, language, path, and timezone but not the declared header values. Although setpagecache adds those names to the response Vary header, getpagecache retrieves the first stored variant under the same header-agnostic key. When CMSPAGECACHE is enabled and a plugin varies content on a header such as Country-Code, one visitor can receive another visitor’s request-specific content, and an unauthenticated attacker can prime the cache with attacker-chosen content. This issue is fixed in versions 5.0.8 and 5.1.0.

Database specific 
{
    "cwe_ids": [
        "CWE-349",
        "CWE-524"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54625.json"
}
References

Affected packages

Git / github.com/django-cms/django-cms

Affected ranges

Type
GIT
Repo
https://github.com/django-cms/django-cms
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Introduced
60e277ccda3a9434af0204d3480d34f971de3da0
Fixed
6da7840759c2b345a0e2fd4e796be001e681c6a4
Fixed
d399600a1c06918757c32b4f06d69118e1a7a5bf
Fixed
8758714b865ffa79c6bcd0e5c503958ea48885aa
Fixed
d5dc1efa18d157445491c4b12c2dd1efd56f439f
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.0.8"
        },
        {
            "introduced": "5.1.0a1"
        },
        {
            "fixed": "5.1.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

2.*
2.1.0
2.1.0.rc2
2.1.0.rc3
2.1.1
2.1.2
2.1.3
2.1.4
2.2
2.3
2.3.2
2.3.2.rc1
2.3.3
2.3.4
2.3.5
2.3rc1
2.4.0
2.4.0.rc1
2.4.1
3.*
3.0
3.0.0.beta
3.0.0.beta2
3.0.0.beta3
3.0.1
3.0.10
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8
3.0.9
3.0c1
3.0c2
3.1
3.2.0
3.2.0.rc1
3.2.0.rc10
3.2.0.rc11
3.2.0.rc12
3.2.0.rc13
3.2.0.rc14
3.2.0.rc3
3.2.0.rc4
3.2.0.rc5
3.2.0.rc6
3.2.0.rc7
3.2.0.rc8
3.2.0.rc9
3.3.0
3.3.0.rc2
3.3.0.rc3
3.3.0.rc4
3.4.0
3.4.0rc1
3.4.0rc2
3.4.0rc3
3.4.1
3.4.2
3.5.0
3.5.0rc1
3.5.1
3.5.2
4.*
4.0.0
4.0.0dev11
5.*
5.0.0
5.0.0a1
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.1.0a1
5.1.0dev1
Other
show
temporary

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54625.json"