CVE-2026-54623
Received Received - Intake

django CMS Plugin Tree Recursion Vulnerability

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the move_plugin endpoint in cms/admin/placeholderadmin.py accepts an attacker-controlled plugin_parent value without rejecting a plugin’s own identifier or a descendant identifier. A staff user with plugin-change permission under CMS_PERMISSION can create a parent_id cycle in the plugin tree. The _get_descendants_cte and _get_ancestors_cte queries in cms/models/pluginmodel.py have no cycle guard, so get_descendants() and later rendering, copy, or delete operations can recurse indefinitely or reach a database recursion limit, corrupting the tree and consuming request workers. This issue is fixed in versions 5.0.8.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-54623
EUVD
EUVD-2026-63565

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
django_cms django_cms 5.0.8
django django_cms to 5.0.8 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
CWE-835 The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in django CMS versions before 5.0.8 allows an authenticated staff user with plugin-change permissions to create a denial of service (DoS) by exploiting the move_plugin admin endpoint. The issue occurs because the endpoint does not prevent a plugin from being reparented under itself or one of its descendants, creating a cyclic dependency in the plugin tree. This cycle causes recursive SQL queries to loop indefinitely or until hitting recursion limits, stalling the request worker and consuming application resources.

Detection Guidance

To detect this vulnerability, check if your django CMS version is below 5.0.8. Run: pip show django-cms or check your requirements.txt. If affected, the vulnerability may manifest as slow or unresponsive plugin operations, database timeouts, or errors during plugin moves, copies, or deletions.

Impact Analysis

The vulnerability can lead to a complete denial of service by consuming all available request workers, making the application unresponsive. It may also corrupt the plugin tree structure, affecting rendering, copying, or deleting plugins in the corrupted subtree. The impact is limited to authenticated staff users with specific permissions.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR or HIPAA by enabling denial-of-service (DoS) attacks that disrupt service availability. A DoS condition may lead to prolonged downtime, potentially violating availability requirements under GDPR Article 32 or HIPAA Security Rule standards for ensuring timely access to systems. The vulnerability does not directly expose data but could create conditions where systems are unavailable, affecting operational compliance.

Mitigation Strategies

Upgrade django CMS to version 5.0.8 or later immediately. No workarounds exist other than upgrading. After upgrading, test plugin move, copy, and delete operations to ensure the cycle prevention works as expected.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54623. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart