CVE-2026-54622 json
django CMS: Clipboard copy IDOR discloses unauthorized plugin content
published 2026-08-20 2 mo ago modified 2026-10-26 14 d ago also EUVD-2026-63568 , GHSA-4xfr-4p46-gc6p , PYSEC-2026-3820
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 36%
- public exploits
- 0
- none known
Summary
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the copy_plugins endpoint in cms/admin/placeholderadmin.py authorizes only the destination clipboard. The _copy_plugin_to_clipboard and _copy_placeholder_to_clipboard paths accept source_placeholder_id and source_plugin_id values but use has_copy_plugins_permission and check_source only for the requesting user’s clipboard, without validating the source placeholder. Under CMS_PERMISSION, a staff user with the global add permission for a plugin type can copy plugins from an unauthorized page or placeholder into the user’s clipboard and read secret text, link names, and URLs. This issue is fixed in versions 5.0.8.
Patch / fix
- pypi django-cms 5.0.8
- django-cms django_cms 5.0.8
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 mo ago
Exploit prediction
0.41% chance of exploitation in the next 30 days, higher than 36% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| OSV | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | django-cms | <5.0.8 |
5.0.8 |
Affected products
- django-cms django-cms
Classification
- Weakness
-
- CWE-639 Authorization Bypass Through User-Controlled Key
References
-
github.com
/django-cms/django-cms/pull/8645
web
-
github.com
/django-cms/django-cms/commit/7642a98ab3170793c0b27b4125dd1f3d318b8a1c
web
-
github.com
/django-cms/django-cms/security/advisories/GHSA-4xfr-4p46-gc6p
web
-
github.com
/django-cms/django-cms/releases/tag/5.0.8
web
-
github.com
/django-cms/django-cms
package
-
pypi.org
/project/django-cms
package
-
github.com
/advisories/GHSA-4xfr-4p46-gc6p
advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-54622
advisory
Sources
- CVE List CVE-2026-54622
- GitHub Advisory GHSA-4xfr-4p46-gc6p
- NVD CVE-2026-54622
- OSV PYSEC-2026-3820
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.