# CVE-2026-54623: django CMS plugin move endpoint denial of service via cyclic reparenting

Source: https://junglewise.ai/threats/cve-2026-54623-django-cms-plugin-move-endpoint-denial-of-service-via-cyclic  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-54623 · Severity: high · CVSS 7.1 · Published 2026-08-20

django CMS is a content management system plugin that allows users to manage page layouts through a plugin tree interface. An authenticated staff member with permission to modify plugins can exploit the move endpoint to create circular references in the plugin hierarchy, causing subsequent requests to hang indefinitely while the application attempts to traverse the corrupted tree structure. This denial of service attack consumes worker processes and renders the affected pages inaccessible.

Technologies: [django-cms (PyPI)](https://junglewise.ai/threats/technologies/django-cms). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-54623 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54623 being exploited in the wild.

**How severe is CVE-2026-54623?** High severity, with a CVSS score of 7.1, published 20 August 2026.

**Which products and versions are affected?** django-cms (PyPI) < 5.0.8, ECOSYSTEM:introduced=0,fixed=5.0.8.

**Is there a fix for CVE-2026-54623?** Yes. django-cms (PyPI): upgrade to 5.0.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54623 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54623?** Check whether you run django-cms (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- django-cms (PyPI): upgrade to 5.0.8 or later

  ```sh
  pip install "django-cms>=5.0.8"
  ```


## Technical details

The vulnerability exists in the move_plugin endpoint (cms/admin/placeholderadmin.py) which accepts a plugin_parent POST parameter without validating that the target parent is not a descendant of the plugin being moved. The vulnerable code directly sets the parent_id without cycle detection. Descendant and ancestor traversal queries in cms/models/pluginmodel.py use WITH RECURSIVE CTEs (_get_descendants_cte, _get_ancestors_cte) with no cycle prevention or depth limits. When a cycle exists in the tree, these queries recurse indefinitely on PostgreSQL/SQLite or hit recursion limits on MySQL. The get_descendants() method is called during the move response and subsequent operations, causing request hangs. The attack requires authentication and CMS_PERMISSION/plugin-change permission on a placeholder. The fix in version 5.0.8 adds validation to reject moves that would create cycles before any tree mutation occurs.

## Affected products

- django-cms django-cms < 5.0.8

## Identifiers

- CVE-2026-54623
- GHSA-8jj7-4v57-frf5
- PYSEC-2026-3822

## Timeline

- 2026-08-24: disclosed: Vulnerability published by GitHub Advisory Database
- 2026-06-12: patched: Fix released in version 5.0.8

## References

- [https://api.github.com/users/Zyy0530](https://api.github.com/users/Zyy0530)
- [https://github.com/Zyy0530](https://github.com/Zyy0530)
- [https://api.github.com/users/Zyy0530/gists%7B/gist_id%7D](https://api.github.com/users/Zyy0530/gists%7B/gist_id%7D)
- [https://api.github.com/users/Zyy0530/repos](https://api.github.com/users/Zyy0530/repos)
- [https://avatars.githubusercontent.com/u/202744044?v=4](https://avatars.githubusercontent.com/u/202744044?v=4)
- [https://api.github.com/users/Zyy0530/events%7B/privacy%7D](https://api.github.com/users/Zyy0530/events%7B/privacy%7D)

## Related threats

- [django CMS stored XSS in edit-mode plugin exception rendering](https://junglewise.ai/threats/cve-2026-75526-django-cms-stored-xss-in-edit-mode-plugin-exception-rendering)
- [django CMS page duplicate authorization bypass](https://junglewise.ai/threats/cve-2026-63003-django-cms-page-duplicate-authorization-bypass)
- [django CMS authorization bypass in render_object_structure](https://junglewise.ai/threats/cve-2026-61663-django-cms-authorization-bypass-in-render-object-structure)
- [django CMS structure endpoint authorization bypass](https://junglewise.ai/threats/cve-2026-54624-django-cms-structure-endpoint-authorization-bypass)
- [django CMS clipboard copy authorization bypass](https://junglewise.ai/threats/cve-2026-54622-django-cms-clipboard-copy-authorization-bypass)