CVE-2026-63003 in Django CMS
Summary
by MITRE • 08/20/2026
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, page duplication lacks an object-level authorization check on the source page. In cms/admin/forms.py, DuplicatePageForm.source accepts any Page, the AddPageForm constructor does not narrow a hidden source field, AddPageForm.clean does not validate the source against the user, and AddPageForm.save calls from_source. In cms/admin/pageadmin.py, duplicate and PageAdmin.has_add_permission check only whether a staff user may add a page. A crafted source value can therefore copy every placeholder and plugin from an unauthorized page with permissions=False, stripping source view restrictions and exposing content across sites or restricted subtrees when CMS_PERMISSION is enabled. This issue is fixed in versions 5.0.9.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified in django CMS prior to version 5.0.9 represents a critical failure in object-level authorization controls within the administrative interface, specifically affecting the page duplication functionality. As an enterprise content management system built on Django, django CMS relies heavily on robust permission models to manage access to sensitive content and structural elements of websites. The core flaw resides in how the backend handles requests for duplicating existing pages. When a staff user initiates a duplicate operation, the process involves several components within the cms/admin/forms.py module, including DuplicatePageForm and AddPageForm. The system fails to verify whether the requesting user has explicit permission to access or manipulate the source page being duplicated. Instead of validating that the user possesses view permissions on the specific Page object identified in the request, the form accepts any valid Page ID provided by the client side without cross-referencing it against the authenticated user's privilege set.
This architectural oversight allows an attacker with basic staff privileges to exploit the duplication mechanism to access content they are otherwise denied permission to view. The technical execution of this flaw involves manipulating the source field in the HTTP request used to trigger page duplication. Because AddPageForm does not narrow or validate the hidden source field against the current user's permissions, and because the clean method fails to perform necessary authorization checks, the system proceeds with the operation regardless of access restrictions. Furthermore, the PageAdmin.has_add_permission check only verifies if the user has general permission to add pages, ignoring specific object-level constraints. Consequently, a malicious actor can craft a request specifying any page ID as the source, effectively bypassing security boundaries designed by site administrators.
The operational impact of this vulnerability is severe, particularly in environments where CMS_PERMISSION is enabled and content is segmented into restricted subtrees or protected sites. By successfully duplicating an unauthorized page, the attacker gains access to all placeholders and plugins contained within that page. This includes sensitive data, internal links, configuration settings, and potentially proprietary content intended for specific audiences only. The duplication process strips away the original view restrictions associated with the source page because the newly created duplicate is typically assigned default permissions or inherits them in a way that does not preserve the restrictive nature of the parent object's access controls. This results in an unauthorized exposure of information across different sites within the same django CMS installation, violating confidentiality requirements and potentially leading to data leakage incidents.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control, specifically reflecting failures in authorization logic where user input is not adequately validated against security policies before processing. It also maps closely to MITRE ATT&CK techniques related to Privilege Escalation and Data Exfiltration via Insecure Permissions, as the attacker leverages a legitimate administrative feature to bypass intended access restrictions. The lack of object-level checks exemplifies a common pitfall in web application development where functional permissions are assumed rather than explicitly enforced at every step of data manipulation.
To mitigate this vulnerability, organizations running django CMS must upgrade immediately to version 5.0.9 or later, which includes the necessary patches to enforce proper authorization checks during page duplication operations. For environments that cannot update instantly due to dependency constraints, temporary mitigations should focus on restricting administrative access to only those users who absolutely require it and ensuring that staff accounts are monitored for unusual activity patterns involving bulk content manipulation. Additionally, implementing strict input validation at the application level to verify user permissions against source objects before processing duplication requests can provide a layer of defense in depth. Regular security audits focusing on object-level authorization logic across all administrative forms are recommended to prevent similar flaws from being introduced or remaining undetected in custom plugins or modified core files.