CVE-2026-61663
Received Received - Intake

Path Traversal in django CMS Admin Interface

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, render_object_structure fails to authorize non-PageContent objects that use PlaceholderRelationField. An active staff user without cms.use_structure or model-level view or change permission can request the //admin/cms/placeholder/object/<content_type_id>/structure/<object_id>/ endpoint with guessed content_type_id and object_id values. The response discloses placeholder slot names, plugin trees, plugin identifiers, labels, and object existence for frontend-editable objects. The fix applies user_can_view_placeholder_source to the non-PageContent branch while keeping the structure board read-only for view-only users. This issue is fixed in versions 5.0.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-61663
EUVD
EUVD-2026-63569

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
django_cms django_cms 5.0.9

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in django CMS (CVE-2026-61663) involves a missing authorization check in the render_object_structure function. It allows low-privileged staff users to access the structure endpoint for non-PageContent objects using PlaceholderRelationField without proper permissions. The endpoint exposes placeholder slot names, plugin identifiers, labels, and object existence via a GET request to /<lang>/admin/cms/placeholder/object/<content_type_id>/structure/<object_id>/. PageContent objects were already protected, but this issue affects other frontend-editable models introduced in django-cms 4.0.0.

The vulnerability requires an authenticated staff account, exposure of a non-PageContent model with placeholders, and knowledge of the target's content_type_id and object_id. The patch adds object-level authorization checks, returning a 404 error if the user lacks permission.

Detection Guidance

To detect this vulnerability, check if unauthenticated or low-privileged staff users can access the structure endpoint for non-PageContent objects. Test with a GET request to /<lang>/admin/cms/placeholder/object/<content_type_id>/structure/<object_id>/. If the response includes placeholder slot names, plugin identifiers, or labels without proper authorization, the system is vulnerable.

Impact Analysis

This vulnerability primarily impacts confidentiality by exposing sensitive editorial structure details. An attacker with a low-privileged staff account could discover placeholder slot names, plugin trees, and object existence for frontend-editable objects. This could help attackers understand the system's structure or identify targets for further attacks, particularly in deployments using custom or third-party apps with frontend-editable objects outside the page tree.

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by exposing sensitive editorial structure details, such as placeholder slot names, plugin identifiers, and labels, through unauthorized access. Unauthorized disclosure of such metadata may lead to violations of data protection requirements, particularly if the exposed objects contain personal or health-related content.

Mitigation Strategies

Upgrade django-cms to version 5.0.9 or later immediately. No configuration workaround exists; patching is required. Verify that only authorized users with proper permissions can access the structure endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61663. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart