CVE-2026-54624 json
django CMS: Structure endpoint bypasses page-view permission
published 2026-08-20 2 mo ago modified 2026-10-26 14 d ago also EUVD-2026-63567 , GHSA-vgxm-h9gx-h9w7 , PYSEC-2026-3826
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 36%
- public exploits
- 0
- none known
Summary
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, render_object_structure in cms/views.py renders cms/toolbar/structure.html for a PageContent object without calling user_can_view_page(). Any staff account can request a restricted page’s structure when CMS_PERMISSION is enabled and the page has view restrictions or CMS_PUBLIC_FOR is set to staff. The response exposes plugin get_short_description() values, including link names, URLs, and text snippets, rather than only the page shape. This issue is fixed in versions 5.0.8.
Patch / fix
- pypi django-cms 5.0.8
- django-cms django_cms 5.0.8
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 mo ago
Exploit prediction
0.41% chance of exploitation in the next 30 days, higher than 36% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| OSV | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | django-cms | <5.0.8 |
5.0.8 |
Affected products
- django-cms django-cms
Classification
References
-
github.com
/django-cms/django-cms/pull/8645
web
-
github.com
/django-cms/django-cms/commit/7642a98ab3170793c0b27b4125dd1f3d318b8a1c
web
-
github.com
/django-cms/django-cms/security/advisories/GHSA-vgxm-h9gx-h9w7
web
-
github.com
/django-cms/django-cms/releases/tag/5.0.8
web
-
github.com
/django-cms/django-cms
package
-
pypi.org
/project/django-cms
package
-
github.com
/advisories/GHSA-vgxm-h9gx-h9w7
advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-54624
advisory
Sources
- CVE List CVE-2026-54624
- GitHub Advisory GHSA-vgxm-h9gx-h9w7
- NVD CVE-2026-54624
- OSV PYSEC-2026-3826
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.