Django CMS up to 5.0.7/5.1.0a1 Page Cache cms/cache/page.py _page_cache_key access control

Summaryinfo

A vulnerability marked as critical has been reported in Django CMS up to 5.0.7/5.1.0a1. This impacts the function _page_cache_key of the file cms/cache/page.py of the component Page Cache. Performing a manipulation results in access control. This vulnerability is identified as CVE-2026-54625. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability classified as critical has been found in Django CMS up to 5.0.7/5.1.0a1. This affects the function _page_cache_key of the file cms/cache/page.py of the component Page Cache. The manipulation with an unknown input leads to a access control vulnerability. CWE is classifying the issue as CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request headers declared by plugins through get_vary_cache_on(). The _page_cache_key function includes the cache prefix, site, language, path, and timezone but not the declared header values. Although set_page_cache adds those names to the response Vary header, get_page_cache retrieves the first stored variant under the same header-agnostic key. When CMS_PAGE_CACHE is enabled and a plugin varies content on a header such as Country-Code, one visitor can receive another visitor’s request-specific content, and an unauthenticated attacker can prime the cache with attacker-chosen content. This issue is fixed in versions 5.0.8 and 5.1.0.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-54625 since 06/15/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/20/2026). The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

Upgrading to version 5.0.8 or 5.1.0 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Content Management System

Name

• Django CMS

Version

• 5.0.0
• 5.0.1
• 5.0.2
• 5.0.3
• 5.0.4
• 5.0.5
• 5.0.6
• 5.0.7
• 5.1.0a1

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion