CVE-2026-63003
Received Received - Intake

Unauthorized Page Duplication in django CMS

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, page duplication lacks an object-level authorization check on the source page. In cms/admin/forms.py, DuplicatePageForm.source accepts any Page, the AddPageForm constructor does not narrow a hidden source field, AddPageForm.clean does not validate the source against the user, and AddPageForm.save calls from_source. In cms/admin/pageadmin.py, duplicate and PageAdmin.has_add_permission check only whether a staff user may add a page. A crafted source value can therefore copy every placeholder and plugin from an unauthorized page with permissions=False, stripping source view restrictions and exposing content across sites or restricted subtrees when CMS_PERMISSION is enabled. This issue is fixed in versions 5.0.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-63003
EUVD
EUVD-2026-63570

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
django-cms django_cms 5.0.9
django-cms django_cms to 5.0.9 (exc)
django django_cms 5.0.9

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in django CMS versions before 5.0.9 allows a staff user with limited permissions to bypass access controls and duplicate pages they are not authorized to view. The issue occurs because the page duplication feature lacks object-level authorization checks on the source page, enabling unauthorized access to restricted content.

Detection Guidance

Check django CMS version with pip show django-cms or python -c "import cms; print(cms.__version__)". If version is 5.0.8 or earlier, the system is vulnerable. Review admin logs for unauthorized page duplication attempts or unusual page creation patterns.

Impact Analysis

An attacker with staff access could duplicate restricted pages, exposing sensitive content to unauthorized users or even anonymous visitors. This bypasses CMS_PERMISSION settings and tenant restrictions, potentially leading to data leaks or compliance violations.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's confidentiality requirements. Organizations using affected versions may face compliance risks due to potential data exposure.

Mitigation Strategies

Upgrade django CMS to version 5.0.9 or later immediately. Temporarily restrict the cms.add_page permission to trusted staff only or disable the duplicate page action in admin settings until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63003. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart