django-cms django CMS up to 5.0.8 Placeholder Authorization render_object_structure content_type_id/object_id improper authorization

Summaryinfo

A vulnerability was found in django-cms django CMS up to 5.0.8. It has been classified as problematic. This vulnerability affects the function render_object_structure of the component Placeholder Authorization. Performing a manipulation of the argument content_type_id/object_id results in improper authorization. This vulnerability is known as CVE-2026-61663. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability, which was classified as problematic, was found in django-cms django CMS up to 5.0.8. This affects the function render_object_structure of the component Placeholder Authorization. The manipulation of the argument content_type_id/object_id with an unknown input leads to a improper authorization vulnerability. CWE is classifying the issue as CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. This is going to have an impact on confidentiality. The summary by CVE is:

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, render_object_structure fails to authorize non-PageContent objects that use PlaceholderRelationField. An active staff user without cms.use_structure or model-level view or change permission can request the //admin/cms/placeholder/object/<content_type_id>/structure/<object_id>/ endpoint with guessed content_type_id and object_id values. The response discloses placeholder slot names, plugin trees, plugin identifiers, labels, and object existence for frontend-editable objects. The fix applies user_can_view_placeholder_source to the non-PageContent branch while keeping the structure board read-only for view-only users. This issue is fixed in versions 5.0.9.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-61663 since 07/10/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. The exploitation requires an enhanced level of successful authentication. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/21/2026). MITRE ATT&CK project uses the attack technique T1548.002 for this issue.

Upgrading to version 5.0.9 eliminates this vulnerability.

The vulnerability is also documented in the databases at CNNVD (CNNVD-2026-98865004) and EUVD (EUVD-2026-63569). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Content Management System

Vendor

• django-cms

Name

• django CMS

Version

• 5.0.0
• 5.0.1
• 5.0.2
• 5.0.3
• 5.0.4
• 5.0.5
• 5.0.6
• 5.0.7
• 5.0.8

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion