PYSEC-2026-3826

See a problem?
Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/django-cms/PYSEC-2026-3826.yaml
JSON Data
https://api.osv.dev/v1/vulns/PYSEC-2026-3826
Aliases
Published
2026-09-10T09:44:52Z
Modified
2026-09-10T12:15:03Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
django CMS: Structure endpoint bypasses page-view permission
Details

Summary

The structure-board endpoint (render_object_structure) renders a page's plugin structure without verifying that the requesting user is allowed to view the page. The edit and preview endpoints enforce this via render_page(), but the structure endpoint does not, allowing a low-privileged staff user to read the plugin structure of a view-restricted page.

Details

render_object_structure (in cms/views.py) loads the PageContent object and renders cms/toolbar/structure.html directly. Unlike render_object_endpoint (used by edit/preview), which renders through render_pagecontent → render_page and calls user_can_view_page(request.user, page) (returning 404 when the user may not view the page), the structure endpoint performs no page-level authorization.

The rendered structure board includes each plugin's get_short_description() (e.g. link names/URLs, text snippets), so the content of a restricted page is disclosed, not just its shape.

Impact

A staff user (any account with is_staff=True) who lacks view permission on a view-restricted page can retrieve that page's plugin structure and short descriptions by requesting the structure endpoint with the page's content-type id and object id.

This only applies when CMS_PERMISSION=True and the page has view restrictions (or CMS_PUBLIC_FOR='staff'). Sites without per-page view restrictions are not affected.

Patches

Fixed in 5.0.8: the structure endpoint now enforces user_can_view_page() for PageContent objects, matching edit/preview.

Workarounds

None other than restricting staff access. Upgrade is recommended.

Credits

Reported by the security team at the University of Sydney ([@reporter]).

References

Affected packages

PyPI / django-cms

Package

Name
django-cms
View open source insights on deps.dev
Purl
pkg:pypi/django-cms

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
5.0.8

Affected versions

2.*
2.0.1
2.0.2
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2
2.2.1
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.3.6
2.3.7
2.3.8
2.4.0
2.4.1
2.4.2
2.4.3
3.*
3.0
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8
3.0.9
3.0.10
3.0.11
3.0.12
3.0.13
3.0.14
3.0.15
3.0.16
3.0.17
3.0.18
3.1.0.b1
3.1.0rc1
3.1.0rc2
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.1.5
3.1.6
3.1.7
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.2.5
3.3.0rc2
3.3.0rc3
3.3.0rc4
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.4.0
3.4.1
3.4.2
3.4.3
3.4.4
3.4.5
3.4.6
3.4.7
3.5.0
3.5.1
3.5.2
3.5.3
3.5.4
3.6.0rc1
3.6.0rc3
3.6.0
3.6.1
3.7.0rc1
3.7.0rc2
3.7.0
3.7.1
3.7.2
3.7.3
3.7.4
3.8.0rc1
3.8.0
3.8.1
3.8.2
3.9.0rc1
3.9.0rc2
3.9.0rc3
3.9.0
3.10.0rc1
3.10.0rc2
3.10.0
3.10.1rc1
3.10.1
3.11.0
3.11.1rc1
3.11.1
3.11.2
3.11.3
3.11.4
3.11.5
3.11.6
3.11.7
3.11.8
3.11.9
3.11.10
3.11.11
4.*
4.1.0rc1
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.0rc5
4.1.0
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.9
4.1.10
4.1.11
5.*
5.0.0a1
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7

Database specific

source 
"https://github.com/pypa/advisory-database/blob/main/vulns/django-cms/PYSEC-2026-3826.yaml"