Executive brief
django CMS is a content management system that allows authorized staff to manage pages and their content. The page duplication feature fails to verify whether a user can access the source page being copied, allowing a staff member with page creation rights but no access to a restricted page to copy that page's content to their own site, making it readable. This bypasses multi-site and permission-based access controls.
Technical details
The vulnerability is a broken object-level authorization (CWE-862, CWE-639) in the page duplication workflow. The DuplicatePageForm.source field accepts any page from the database (queryset=Page.objects.all()) without validating user permissions. The PageAdmin.duplicate() method only checks has_add_permission (can the user create pages at all), not whether they can view/change the source page. On GET requests, source is safely seeded from the URL; on POST, the attacker supplies source directly in the request body. The AddPageForm.clean() method validates only slug uniqueness, never checking source permissions. When saved, Page.copy(permissions=False) copies all placeholders and plugins while stripping view restrictions, resulting in an unrestricted page. The attacker can then read the duplicated content via the front end. Patch 5.0.9+ adds a clean_source() validation using user_can_view_page().
Affected products
- django-cms django-cms <= 5.0.8
Timeline
- 2026-07-10: disclosed
- 2026-08-20: advisory
- 2026-08-20: patched: Version 5.0.9 released