# CVE-2026-63003: django CMS page duplicate authorization bypass

Source: https://junglewise.ai/threats/cve-2026-63003-django-cms-page-duplicate-authorization-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-63003 · Severity: medium · CVSS 6.5 · Published 2026-08-20

django CMS is a content management system that allows authorized staff to manage pages and their content. The page duplication feature fails to verify whether a user can access the source page being copied, allowing a staff member with page creation rights but no access to a restricted page to copy that page's content to their own site, making it readable. This bypasses multi-site and permission-based access controls.

Technologies: [django-cms (PyPI)](https://junglewise.ai/threats/technologies/django-cms). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-63003 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63003 being exploited in the wild.

**How severe is CVE-2026-63003?** Medium severity, with a CVSS score of 6.5, published 20 August 2026.

**Which products and versions are affected?** django-cms (PyPI) <= 5.0.8, ECOSYSTEM:introduced=0,fixed=5.0.9.

**Is there a fix for CVE-2026-63003?** Yes. django-cms (PyPI): upgrade to 5.0.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-63003 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-63003?** Check whether you run django-cms (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- django-cms (PyPI): upgrade to 5.0.9 or later

  ```sh
  pip install "django-cms>=5.0.9"
  ```


## Technical details

The vulnerability is a broken object-level authorization (CWE-862, CWE-639) in the page duplication workflow. The DuplicatePageForm.source field accepts any page from the database (queryset=Page.objects.all()) without validating user permissions. The PageAdmin.duplicate() method only checks has_add_permission (can the user create pages at all), not whether they can view/change the source page. On GET requests, source is safely seeded from the URL; on POST, the attacker supplies source directly in the request body. The AddPageForm.clean() method validates only slug uniqueness, never checking source permissions. When saved, Page.copy(permissions=False) copies all placeholders and plugins while stripping view restrictions, resulting in an unrestricted page. The attacker can then read the duplicated content via the front end. Patch 5.0.9+ adds a clean_source() validation using user_can_view_page().

## Affected products

- django-cms django-cms <= 5.0.8

## Identifiers

- CVE-2026-63003
- GHSA-6x92-6vx4-5fwr
- PYSEC-2026-3821

## Timeline

- 2026-07-10: disclosed
- 2026-08-20: advisory
- 2026-08-20: patched: Version 5.0.9 released

## References

- [https://api.github.com/users/fsbraun](https://api.github.com/users/fsbraun)
- [https://github.com/fsbraun](https://github.com/fsbraun)
- [https://api.github.com/users/fsbraun/gists%7B/gist_id%7D](https://api.github.com/users/fsbraun/gists%7B/gist_id%7D)
- [https://api.github.com/users/fsbraun/repos](https://api.github.com/users/fsbraun/repos)
- [https://avatars.githubusercontent.com/u/16904477?v=4](https://avatars.githubusercontent.com/u/16904477?v=4)
- [https://api.github.com/users/fsbraun/events%7B/privacy%7D](https://api.github.com/users/fsbraun/events%7B/privacy%7D)

## Related threats

- [django CMS stored XSS in edit-mode plugin exception rendering](https://junglewise.ai/threats/cve-2026-75526-django-cms-stored-xss-in-edit-mode-plugin-exception-rendering)
- [django CMS authorization bypass in render_object_structure](https://junglewise.ai/threats/cve-2026-61663-django-cms-authorization-bypass-in-render-object-structure)
- [django CMS structure endpoint authorization bypass](https://junglewise.ai/threats/cve-2026-54624-django-cms-structure-endpoint-authorization-bypass)
- [django CMS clipboard copy authorization bypass](https://junglewise.ai/threats/cve-2026-54622-django-cms-clipboard-copy-authorization-bypass)
- [django CMS page cache ignores plugin Vary headers](https://junglewise.ai/threats/cve-2026-54625-django-cms-page-cache-ignores-plugin-vary-headers)