CVE-2026-54623 json
django CMS: Plugin move endpoint allows cyclic reparenting (DoS)
published 2026-08-20 2 mo ago modified 2026-10-26 14 d ago also EUVD-2026-63565 , GHSA-8jj7-4v57-frf5 , PYSEC-2026-3822
- cvss
- 7.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 42%
- public exploits
- 0
- none known
Summary
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the move_plugin endpoint in cms/admin/placeholderadmin.py accepts an attacker-controlled plugin_parent value without rejecting a plugin’s own identifier or a descendant identifier. A staff user with plugin-change permission under CMS_PERMISSION can create a parent_id cycle in the plugin tree. The _get_descendants_cte and _get_ancestors_cte queries in cms/models/pluginmodel.py have no cycle guard, so get_descendants() and later rendering, copy, or delete operations can recurse indefinitely or reach a database recursion limit, corrupting the tree and consuming request workers. This issue is fixed in versions 5.0.8.
Patch / fix
- pypi django-cms 5.0.8
- django-cms django_cms 5.0.8
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 mo ago
Exploit prediction
0.49% chance of exploitation in the next 30 days, higher than 42% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H |
| GitHub | 3.1 | 7.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H |
| OSV | 3.1 | 7.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | django-cms | <5.0.8 |
5.0.8 |
Affected products
- django-cms django-cms
Classification
References
-
github.com
/django-cms/django-cms/pull/8645
web
-
github.com
/django-cms/django-cms/commit/7642a98ab3170793c0b27b4125dd1f3d318b8a1c
web
-
github.com
/django-cms/django-cms/security/advisories/GHSA-8jj7-4v57-frf5
web
-
github.com
/django-cms/django-cms/releases/tag/5.0.8
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-54623
advisory
-
github.com
/django-cms/django-cms
package
-
pypi.org
/project/django-cms
package
-
github.com
/advisories/GHSA-8jj7-4v57-frf5
advisory
Sources
- CVE List CVE-2026-54623
- GitHub Advisory GHSA-8jj7-4v57-frf5
- NVD CVE-2026-54623
- OSV PYSEC-2026-3822
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.