Is CVE-2026-54622 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54622 being exploited in the wild.

How severe is CVE-2026-54622?

Medium severity, with a CVSS score of 6.5, published 20 August 2026.

Which products and versions are affected?

django-cms (PyPI) < 5.0.8, ECOSYSTEM:introduced=0,fixed=5.0.8.

Is there a fix for CVE-2026-54622?

Yes. django-cms (PyPI): upgrade to 5.0.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54622 attacked?

It is attacked over the network.

Am I affected by CVE-2026-54622?

Check whether you run django-cms (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54622: django CMS clipboard copy authorization bypass

Q: Which products and versions are affected?

django-cms (PyPI) < 5.0.8, ECOSYSTEM:introduced=0,fixed=5.0.8.

Q: Is there a fix for CVE-2026-54622?

Yes. django-cms (PyPI): upgrade to 5.0.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-54622 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-54622?

Check whether you run django-cms (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54622 · Severity: medium · CVSS 6.5 · Published 2026-08-20

django CMS is a popular content management system that allows administrators to manage web pages and plugins. The vulnerability exists in the admin interface's clipboard copy feature, which is used to duplicate content between pages. A staff member who has limited permissions (only allowed to manage certain pages) can exploit a flaw to copy content from restricted pages they shouldn't access, read the hidden information, and potentially compromise content governance. This only affects deployments using django CMS's permission system with per-page/placeholder restrictions enabled.

Technologies: django-cms (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-54622 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54622 being exploited in the wild.
How severe is CVE-2026-54622?: Medium severity, with a CVSS score of 6.5, published 20 August 2026.
Which products and versions are affected?: django-cms (PyPI) < 5.0.8, ECOSYSTEM:introduced=0,fixed=5.0.8.
Is there a fix for CVE-2026-54622?: Yes. django-cms (PyPI): upgrade to 5.0.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54622 attacked?: It is attacked over the network.
Am I affected by CVE-2026-54622?: Check whether you run django-cms (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

django-cms (PyPI): upgrade to 5.0.8 or later
```
pip install "django-cms>=5.0.8"
```

Technical details

An Indirect Object Reference (IDOR) / authorization bypass exists in cms/admin/placeholderadmin.py where the _copy_plugin_to_clipboard and _copy_placeholder_to_clipboard functions validate only the destination (target clipboard) using has_copy_plugins_permission but fail to authorize access to the source placeholder identified by attacker-supplied source_placeholder_id or source_plugin_id parameters. The vulnerability class is CWE-639 (Authorization Bypass Through User-Controlled Key). Exploitation requires: (1) CMS_PERMISSION=True with per-placeholder/page restrictions configured, (2) staff account with global plugin add permission but restricted placeholder access, and (3) network access to the admin interface. An attacker can copy plugins from restricted placeholders into their clipboard and read sensitive content. The fix in version 5.0.8 adds source-side permission checks (has_add_plugins_permission + check_source on the source placeholder) matching the already-correct placeholder-to-placeholder copy logic.

Affected products

django-cms django-cms < 5.0.8

Identifiers

CVE-2026-54622
GHSA-4xfr-4p46-gc6p
PYSEC-2026-3820

Timeline

2026-08-20: disclosed: Published to GitHub Advisory Database
2026-05-08: patched: Fixed in version 5.0.8

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.