Executive brief
django CMS's page caching feature fails to account for content variations declared by plugins, causing the first visitor's version of a page to be served to all subsequent users. This vulnerability allows information disclosure when plugins customize content based on visitor attributes (e.g., location, user type), and enables unauthenticated attackers to inject malicious content into the cache that will be displayed to other users.
Technical details
The vulnerability exists in the `_page_cache_key` function (cms/cache/page.py), which constructs cache keys using only cache prefix, site, language, path, and timezone—omitting request header values that plugins declare via `get_vary_cache_on()`. While the response's HTTP `Vary` header is correctly set via `patch_vary_headers()`, the underlying cache retrieval logic ignores these header-dependent variations. An attacker can craft requests with specific header values to prime the anonymous page cache; the poisoned variant is then served to all subsequent visitors until cache expiration. The vulnerability requires CMS_PAGE_CACHE to be enabled and at least one plugin implementing `get_vary_cache_on()`. Fixed in version 5.0.8 by incorporating plugin-declared vary header values into the cache key and persisting the set of vary headers on write.
Affected products
- Django CMS Project django-cms < 5.0.8
Timeline
- 2026-06-12: disclosed
- 2026-06-12: patched: Fixed in version 5.0.8
- 2026-08-24: advisory