{"id":"CVE-2026-54624","aliases":["GHSA-vgxm-h9gx-h9w7","PYSEC-2026-3826"],"url":"https://o3.security/vulnerability/CVE-2026-54624","summary":"django CMS: Structure endpoint bypasses page-view permission","details":"### Summary\nThe structure-board endpoint (`render_object_structure`) renders a page's plugin structure without verifying that the requesting user is allowed to view the page. The edit and preview endpoints enforce this via `render_page()`, but the structure endpoint does not, allowing a low-privileged staff user to read the plugin structure of a view-restricted page.\n\n### Details\n`render_object_structure` (in `cms/views.py`) loads the `PageContent` object and renders `cms/toolbar/structure.html` directly. Unlike `render_object_endpoint` (used by edit/preview), which renders through `render_pagecontent` → `render_page` and calls `user_can_view_page(request.user, page)` (returning 404 when the user may not view the page), the structure endpoint performs no page-level authorization.\n\nThe rendered structure board includes each plugin's `get_short_description()`  (e.g. link names/URLs, text snippets), so the content of a restricted page is disclosed, not just its shape.\n\n### Impact\nA staff user (any account with `is_staff=True`) who lacks view permission on a  view-restricted page can retrieve that page's plugin structure and short descriptions by requesting the structure endpoint with the page's content-type id and object id.\n\nThis only applies when `CMS_PERMISSION=True` and the page has view restrictions (or `CMS_PUBLIC_FOR='staff'`). Sites without per-page view restrictions are not affected.\n\n### Patches\nFixed in 5.0.8: the structure endpoint now enforces `user_can_view_page()` for `PageContent` objects, matching edit/preview.\n\n### Workarounds\nNone other than restricting staff access. Upgrade is recommended.\n\n### Credits\nReported by the security team at the University of Sydney ([@reporter]).","published":"2026-08-20T18:04:38.766Z","modified":"2026-09-11T03:30:18.553843949Z","cvss":{"score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},"epss":{"score":0.00244,"percentile":0.15772,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"django-cms","fixedVersion":"5.0.8"}],"fix":{"url":"https://github.com/django-cms/django-cms/commit/7642a98ab3170793c0b27b4125dd1f3d318b8a1c","label":"django-cms/django-cms@7642a98"},"references":[{"type":"WEB","url":"https://github.com/django-cms/django-cms/releases/tag/5.0.8"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54624.json"},{"type":"ADVISORY","url":"https://github.com/django-cms/django-cms/security/advisories/GHSA-vgxm-h9gx-h9w7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54624"},{"type":"FIX","url":"https://github.com/django-cms/django-cms/commit/7642a98ab3170793c0b27b4125dd1f3d318b8a1c"},{"type":"FIX","url":"https://github.com/django-cms/django-cms/pull/8645"},{"type":"PACKAGE","url":"https://github.com/django-cms/django-cms"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-11T03:30:18.553843949Z"}}