Executive brief
django CMS is a popular content management system that allows administrators to manage web pages and plugins. The vulnerability exists in the admin interface's clipboard copy feature, which is used to duplicate content between pages. A staff member who has limited permissions (only allowed to manage certain pages) can exploit a flaw to copy content from restricted pages they shouldn't access, read the hidden information, and potentially compromise content governance. This only affects deployments using django CMS's permission system with per-page/placeholder restrictions enabled.
Technical details
An Indirect Object Reference (IDOR) / authorization bypass exists in cms/admin/placeholderadmin.py where the _copy_plugin_to_clipboard and _copy_placeholder_to_clipboard functions validate only the destination (target clipboard) using has_copy_plugins_permission but fail to authorize access to the source placeholder identified by attacker-supplied source_placeholder_id or source_plugin_id parameters. The vulnerability class is CWE-639 (Authorization Bypass Through User-Controlled Key). Exploitation requires: (1) CMS_PERMISSION=True with per-placeholder/page restrictions configured, (2) staff account with global plugin add permission but restricted placeholder access, and (3) network access to the admin interface. An attacker can copy plugins from restricted placeholders into their clipboard and read sensitive content. The fix in version 5.0.8 adds source-side permission checks (has_add_plugins_permission + check_source on the source placeholder) matching the already-correct placeholder-to-placeholder copy logic.
Affected products
- django-cms django-cms < 5.0.8
Timeline
- 2026-08-20: disclosed: Published to GitHub Advisory Database
- 2026-05-08: patched: Fixed in version 5.0.8