PYSEC-2026-3820

See a problem?
Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/django-cms/PYSEC-2026-3820.yaml
JSON Data
https://api.osv.dev/v1/vulns/PYSEC-2026-3820
Aliases
Published
2026-09-10T09:44:52Z
Modified
2026-09-10T12:15:06Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
django CMS: Clipboard copy IDOR discloses unauthorized plugin content
Details

Summary

The clipboard copy paths of the copy_plugins admin endpoint validate only the target (the user's own clipboard) and skip source-side authorization. A staff user can copy plugins out of a placeholder they have no permission on into their clipboard, then read the (secret) content.

Details

In cms/admin/placeholderadmin.py, _copy_plugin_to_clipboard and _copy_placeholder_to_clipboard check has_copy_plugins_permission, which only evaluates request.toolbar.clipboard.has_add_plugins_permission(...) — the clipboard belongs to the requesting user, and check_source is likewise applied only to the clipboard. The source placeholder identified by the attacker-supplied source_placeholder_id / source_plugin_id is never authorization-checked. (The placeholder-to-placeholder copy path, has_copy_from_placeholder_permission, correctly checks both sides.)

Impact

A staff user holding the global add permission for a plugin type, but with no access to a given placeholder/page, can copy that placeholder's plugins into their own clipboard and read content (e.g. link names/URLs, text) they cannot reach through the normal edit endpoints.

Requires CMS_PERMISSION=True with per-placeholder/page restrictions.

Patches

Fixed in 5.0.8: the clipboard copy paths now also verify source-side permission (has_add_plugins_permission + check_source on the source placeholder), matching placeholder-to-placeholder copy.

Workarounds

None. Upgrade is recommended.

Credits

Reported by the security team at the University of Sydney ([@reporter]).

References

Affected packages

PyPI / django-cms

Package

Name
django-cms
View open source insights on deps.dev
Purl
pkg:pypi/django-cms

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
5.0.8

Affected versions

2.*
2.0.1
2.0.2
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2
2.2.1
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.3.6
2.3.7
2.3.8
2.4.0
2.4.1
2.4.2
2.4.3
3.*
3.0
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8
3.0.9
3.0.10
3.0.11
3.0.12
3.0.13
3.0.14
3.0.15
3.0.16
3.0.17
3.0.18
3.1.0.b1
3.1.0rc1
3.1.0rc2
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.1.5
3.1.6
3.1.7
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.2.5
3.3.0rc2
3.3.0rc3
3.3.0rc4
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.4.0
3.4.1
3.4.2
3.4.3
3.4.4
3.4.5
3.4.6
3.4.7
3.5.0
3.5.1
3.5.2
3.5.3
3.5.4
3.6.0rc1
3.6.0rc3
3.6.0
3.6.1
3.7.0rc1
3.7.0rc2
3.7.0
3.7.1
3.7.2
3.7.3
3.7.4
3.8.0rc1
3.8.0
3.8.1
3.8.2
3.9.0rc1
3.9.0rc2
3.9.0rc3
3.9.0
3.10.0rc1
3.10.0rc2
3.10.0
3.10.1rc1
3.10.1
3.11.0
3.11.1rc1
3.11.1
3.11.2
3.11.3
3.11.4
3.11.5
3.11.6
3.11.7
3.11.8
3.11.9
3.11.10
3.11.11
4.*
4.1.0rc1
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.0rc5
4.1.0
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.9
4.1.10
4.1.11
5.*
5.0.0a1
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7

Database specific

source 
"https://github.com/pypa/advisory-database/blob/main/vulns/django-cms/PYSEC-2026-3820.yaml"