{"id":"CVE-2026-93455","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-93455","summary":"django-page-cms through 2.0.13 fails to properly validate page permissions in admin helper views, allowing any staff account to read arbitrary page content and stored media paths. Attackers…","details":"django-page-cms through 2.0.13 fails to properly validate page permissions in admin helper views, allowing any staff account to read arbitrary page content and stored media paths. Attackers with low-privilege staff credentials can enumerate content identifiers and access unpublished drafts, page listings, and file paths without proper authorization checks.","published":"2026-09-18T01:24:04.211Z","modified":"2026-09-18T01:24:04.211Z","cvss":{"score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":null,"references":[{"type":"REPORT","url":"https://github.com/batiste/django-page-cms/issues/244"},{"type":"WEB","url":"https://github.com/batiste/django-page-cms"},{"type":"WEB","url":"https://github.com/batiste/django-page-cms/blob/bc4cbe6c187d2d4573289c5695ce8dec0556994d/pages/admin/views.py#L174-L178"},{"type":"WEB","url":"https://github.com/batiste/django-page-cms/blob/bc4cbe6c187d2d4573289c5695ce8dec0556994d/pages/admin/views.py#L226-L229"},{"type":"WEB","url":"https://github.com/batiste/django-page-cms/blob/bc4cbe6c187d2d4573289c5695ce8dec0556994d/pages/admin/views.py#L35-L36"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/django-page-cms-through-2.0.13-unauthorized-content-access-via-staff-account"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-09-18T01:24:04.211Z"}}