Executive brief
django CMS is a popular content management system used to build and manage websites. A flaw in the structure-board endpoint allows staff members to view the internal structure and content snippets of pages they should not have access to. This bypasses intended page-level view restrictions and could expose sensitive information about restricted content and its organization, potentially affecting data confidentiality and user privacy.
Technical details
The vulnerability is a missing authorization check (CWE-862) in the `render_object_structure` function within `cms/views.py`. Unlike `render_object_endpoint` (used for edit/preview operations), which enforces `user_can_view_page(request.user, page)` before rendering, the structure endpoint loads the `PageContent` object and renders `cms/toolbar/structure.html` directly without permission validation. The rendered output includes each plugin's `get_short_description()` method output (e.g., link names, URLs, text snippets), disclosing restricted page content. The vulnerability requires: (1) CMS_PERMISSION to be enabled, (2) pages with view restrictions configured (or CMS_PUBLIC_FOR='staff'), (3) attacker to be a staff user (is_staff=True), and (4) network access to the structure endpoint with a page's content-type ID and object ID. The fix (version 5.0.8) adds authorization enforcement matching edit/preview endpoints.
Affected products
- django-cms django-cms < 5.0.8
Timeline
- 2026-06-12: disclosed: Published by GitHub as reviewed advisory
- 2026-08-20: advisory: Updated and indexed in GitHub Advisory Database
- 2026-08-20: patched: Fix released in version 5.0.8