CVE-2026-63003: django CMS page duplicate authorization bypass

CVE-2026-63003 · Severity: medium · CVSS 6.5 · Published 2026-08-20

django CMS is a content management system that allows authorized staff to manage pages and their content. The page duplication feature fails to verify whether a user can access the source page being copied, allowing a staff member with page creation rights but no access to a restricted page to copy that page's content to their own site, making it readable. This bypasses multi-site and permission-based access controls.

Technologies: django-cms (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-63003 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-63003 being exploited in the wild.
How severe is CVE-2026-63003?
Medium severity, with a CVSS score of 6.5, published 20 August 2026.
Which products and versions are affected?
django-cms (PyPI) <= 5.0.8, ECOSYSTEM:introduced=0,fixed=5.0.9.
Is there a fix for CVE-2026-63003?
Yes. django-cms (PyPI): upgrade to 5.0.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63003 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-63003?
Check whether you run django-cms (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • django-cms (PyPI): upgrade to 5.0.9 or later
    pip install "django-cms>=5.0.9"

Technical details

The vulnerability is a broken object-level authorization (CWE-862, CWE-639) in the page duplication workflow. The DuplicatePageForm.source field accepts any page from the database (queryset=Page.objects.all()) without validating user permissions. The PageAdmin.duplicate() method only checks has_add_permission (can the user create pages at all), not whether they can view/change the source page. On GET requests, source is safely seeded from the URL; on POST, the attacker supplies source directly in the request body. The AddPageForm.clean() method validates only slug uniqueness, never checking source permissions. When saved, Page.copy(permissions=False) copies all placeholders and plugins while stripping view restrictions, resulting in an unrestricted page. The attacker can then read the duplicated content via the front end. Patch 5.0.9+ adds a clean_source() validation using user_can_view_page().

Affected products

  • django-cms django-cms <= 5.0.8

Identifiers

  • CVE-2026-63003
  • GHSA-6x92-6vx4-5fwr
  • PYSEC-2026-3821

Timeline

  • 2026-07-10: disclosed
  • 2026-08-20: advisory
  • 2026-08-20: patched: Version 5.0.9 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.