CVE-2026-54625
Received Received - Intake

django CMS Page Cache Header Handling Flaw

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description
django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request headers declared by plugins through get_vary_cache_on(). The _page_cache_key function includes the cache prefix, site, language, path, and timezone but not the declared header values. Although set_page_cache adds those names to the response Vary header, get_page_cache retrieves the first stored variant under the same header-agnostic key. When CMS_PAGE_CACHE is enabled and a plugin varies content on a header such as Country-Code, one visitor can receive another visitor’s request-specific content, and an unauthenticated attacker can prime the cache with attacker-chosen content. This issue is fixed in versions 5.0.8 and 5.1.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-54625
EUVD
EUVD-2026-63564

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
django django_cms 5.0.8
django django_cms 5.1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-349 The product, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted.
CWE-524 The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in django CMS affects versions prior to 5.0.8 and 5.1.0a1. The page cache ignores request headers declared by plugins through get_vary_cache_on(). The cache key only includes cache prefix, site, language, path, and timezone but not header values. This causes the first stored variant to be served to all users regardless of their header values, potentially leaking content between users or allowing cache poisoning.

Detection Guidance

Check if your django CMS version is below 5.0.8 or 5.1.0. Inspect plugins using get_vary_cache_on() for Country-Code or similar headers. Review cache headers in responses for Vary fields not reflected in cache keys. Use Django cache inspection tools to compare cache keys with actual vary headers.

Impact Analysis

An attacker could exploit this by priming the cache with malicious content. When CMS_PAGE_CACHE is enabled and plugins use get_vary_cache_on(), users may receive another user's request-specific content. This could lead to information disclosure, unauthorized access to sensitive data, or exposure to attacker-controlled content.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection principles and HIPAA's confidentiality requirements. It may result in unauthorized access to personal or health information, potentially leading to regulatory penalties and loss of compliance certifications.

Mitigation Strategies

Upgrade django CMS to version 5.0.8 or 5.1.0 immediately. Disable CMS_PAGE_CACHE as a temporary workaround if upgrading is not possible. Audit plugins for get_vary_cache_on() usage and avoid plugins that rely on vary headers until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54625. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart