Is CVE-2026-54624 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54624 being exploited in the wild.

How severe is CVE-2026-54624?

Medium severity, with a CVSS score of 6.5, published 20 August 2026.

Which products and versions are affected?

django-cms (PyPI) < 5.0.8, ECOSYSTEM:introduced=0,fixed=5.0.8.

Is there a fix for CVE-2026-54624?

Yes. django-cms (PyPI): upgrade to 5.0.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54624 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-54624?

Check whether you run django-cms (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54624: django CMS structure endpoint authorization bypass

Q: Which products and versions are affected?

django-cms (PyPI) < 5.0.8, ECOSYSTEM:introduced=0,fixed=5.0.8.

Q: Is there a fix for CVE-2026-54624?

Yes. django-cms (PyPI): upgrade to 5.0.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-54624 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-54624?

Check whether you run django-cms (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54624 · Severity: medium · CVSS 6.5 · Published 2026-08-20

django CMS is a popular content management system used to build and manage websites. A flaw in the structure-board endpoint allows staff members to view the internal structure and content snippets of pages they should not have access to. This bypasses intended page-level view restrictions and could expose sensitive information about restricted content and its organization, potentially affecting data confidentiality and user privacy.

Technologies: django-cms (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-54624 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54624 being exploited in the wild.
How severe is CVE-2026-54624?: Medium severity, with a CVSS score of 6.5, published 20 August 2026.
Which products and versions are affected?: django-cms (PyPI) < 5.0.8, ECOSYSTEM:introduced=0,fixed=5.0.8.
Is there a fix for CVE-2026-54624?: Yes. django-cms (PyPI): upgrade to 5.0.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54624 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-54624?: Check whether you run django-cms (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

django-cms (PyPI): upgrade to 5.0.8 or later
```
pip install "django-cms>=5.0.8"
```

Technical details

The vulnerability is a missing authorization check (CWE-862) in the `render_object_structure` function within `cms/views.py`. Unlike `render_object_endpoint` (used for edit/preview operations), which enforces `user_can_view_page(request.user, page)` before rendering, the structure endpoint loads the `PageContent` object and renders `cms/toolbar/structure.html` directly without permission validation. The rendered output includes each plugin's `get_short_description()` method output (e.g., link names, URLs, text snippets), disclosing restricted page content. The vulnerability requires: (1) CMS_PERMISSION to be enabled, (2) pages with view restrictions configured (or CMS_PUBLIC_FOR='staff'), (3) attacker to be a staff user (is_staff=True), and (4) network access to the structure endpoint with a page's content-type ID and object ID. The fix (version 5.0.8) adds authorization enforcement matching edit/preview endpoints.

Affected products

django-cms django-cms < 5.0.8

Identifiers

CVE-2026-54624
GHSA-vgxm-h9gx-h9w7
PYSEC-2026-3826

Timeline

2026-06-12: disclosed: Published by GitHub as reviewed advisory
2026-08-20: advisory: Updated and indexed in GitHub Advisory Database
2026-08-20: patched: Fix released in version 5.0.8

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.