CVE-2026-54622
Received Received - Intake

Stored XSS in django CMS via Clipboard Copy

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the copy_plugins endpoint in cms/admin/placeholderadmin.py authorizes only the destination clipboard. The _copy_plugin_to_clipboard and _copy_placeholder_to_clipboard paths accept source_placeholder_id and source_plugin_id values but use has_copy_plugins_permission and check_source only for the requesting user’s clipboard, without validating the source placeholder. Under CMS_PERMISSION, a staff user with the global add permission for a plugin type can copy plugins from an unauthorized page or placeholder into the user’s clipboard and read secret text, link names, and URLs. This issue is fixed in versions 5.0.8.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-54622
EUVD
EUVD-2026-63568

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
django-cms django-cms to 5.0.8 (inc)
django_cms django_cms 5.0.8

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-54622 is an Insecure Direct Object Reference (IDOR) vulnerability in django CMS versions prior to 5.0.8. It affects the clipboard copy functionality in the admin endpoint. A staff user with global add permission for a plugin type but no access to a specific placeholder or page can exploit this flaw to copy plugins from unauthorized sources into their clipboard and read sensitive content like link names, URLs, or text. The issue occurs because the clipboard copy paths only validate the target (user's clipboard) and do not check source-side authorization for the placeholder or plugin being copied.

Detection Guidance

To detect this vulnerability, check if your django CMS version is prior to 5.0.8. Run: pip show django-cms or python -c "import cms; print(cms.__version__)" to verify the installed version.

Impact Analysis

This vulnerability allows unauthorized staff users to access and read sensitive information such as secret text, link names, and URLs from pages or placeholders they are not permitted to view. This could lead to data leaks, unauthorized information gathering, or potential misuse of confidential content. The impact is primarily on confidentiality, as attackers can exfiltrate data without proper authorization.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, and other data protection regulations by enabling unauthorized access to sensitive data. It may result in data breaches, violating confidentiality requirements and potentially leading to legal penalties, reputational damage, and loss of trust. Organizations using affected versions must upgrade to mitigate these risks.

Mitigation Strategies

Upgrade django CMS to version 5.0.8 or later immediately. No workarounds exist; upgrading is the only mitigation. Verify the update with pip install --upgrade django-cms==5.0.8 or your package manager.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54622. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart