# CVE-2026-54624: django CMS structure endpoint authorization bypass

Source: https://junglewise.ai/threats/cve-2026-54624-django-cms-structure-endpoint-authorization-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-54624 · Severity: medium · CVSS 6.5 · Published 2026-08-20

django CMS is a popular content management system used to build and manage websites. A flaw in the structure-board endpoint allows staff members to view the internal structure and content snippets of pages they should not have access to. This bypasses intended page-level view restrictions and could expose sensitive information about restricted content and its organization, potentially affecting data confidentiality and user privacy.

Technologies: [django-cms (PyPI)](https://junglewise.ai/threats/technologies/django-cms). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-54624 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54624 being exploited in the wild.

**How severe is CVE-2026-54624?** Medium severity, with a CVSS score of 6.5, published 20 August 2026.

**Which products and versions are affected?** django-cms (PyPI) < 5.0.8, ECOSYSTEM:introduced=0,fixed=5.0.8.

**Is there a fix for CVE-2026-54624?** Yes. django-cms (PyPI): upgrade to 5.0.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54624 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54624?** Check whether you run django-cms (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- django-cms (PyPI): upgrade to 5.0.8 or later

  ```sh
  pip install "django-cms>=5.0.8"
  ```


## Technical details

The vulnerability is a missing authorization check (CWE-862) in the `render_object_structure` function within `cms/views.py`. Unlike `render_object_endpoint` (used for edit/preview operations), which enforces `user_can_view_page(request.user, page)` before rendering, the structure endpoint loads the `PageContent` object and renders `cms/toolbar/structure.html` directly without permission validation. The rendered output includes each plugin's `get_short_description()` method output (e.g., link names, URLs, text snippets), disclosing restricted page content. The vulnerability requires: (1) CMS_PERMISSION to be enabled, (2) pages with view restrictions configured (or CMS_PUBLIC_FOR='staff'), (3) attacker to be a staff user (is_staff=True), and (4) network access to the structure endpoint with a page's content-type ID and object ID. The fix (version 5.0.8) adds authorization enforcement matching edit/preview endpoints.

## Affected products

- django-cms django-cms < 5.0.8

## Identifiers

- CVE-2026-54624
- GHSA-vgxm-h9gx-h9w7
- PYSEC-2026-3826

## Timeline

- 2026-06-12: disclosed: Published by GitHub as reviewed advisory
- 2026-08-20: advisory: Updated and indexed in GitHub Advisory Database
- 2026-08-20: patched: Fix released in version 5.0.8

## References

- [https://api.github.com/users/Zyy0530](https://api.github.com/users/Zyy0530)
- [https://github.com/Zyy0530](https://github.com/Zyy0530)
- [https://api.github.com/users/Zyy0530/gists%7B/gist_id%7D](https://api.github.com/users/Zyy0530/gists%7B/gist_id%7D)
- [https://api.github.com/users/Zyy0530/repos](https://api.github.com/users/Zyy0530/repos)
- [https://avatars.githubusercontent.com/u/202744044?v=4](https://avatars.githubusercontent.com/u/202744044?v=4)
- [https://api.github.com/users/Zyy0530/events%7B/privacy%7D](https://api.github.com/users/Zyy0530/events%7B/privacy%7D)

## Related threats

- [django CMS stored XSS in edit-mode plugin exception rendering](https://junglewise.ai/threats/cve-2026-75526-django-cms-stored-xss-in-edit-mode-plugin-exception-rendering)
- [django CMS page duplicate authorization bypass](https://junglewise.ai/threats/cve-2026-63003-django-cms-page-duplicate-authorization-bypass)
- [django CMS authorization bypass in render_object_structure](https://junglewise.ai/threats/cve-2026-61663-django-cms-authorization-bypass-in-render-object-structure)
- [django CMS clipboard copy authorization bypass](https://junglewise.ai/threats/cve-2026-54622-django-cms-clipboard-copy-authorization-bypass)
- [django CMS page cache ignores plugin Vary headers](https://junglewise.ai/threats/cve-2026-54625-django-cms-page-cache-ignores-plugin-vary-headers)