Authorization Flaw in django CMS Allows Unauthorized Access to Clipboard Content

CVE-2026-54622

What is CVE-2026-54622?

In versions prior to 5.0.8, django CMS contains an authorization flaw in the copy_plugins endpoint within cms/admin/placeholderadmin.py. This vulnerability permits staff users with global add permission for plugin types to copy plugins from unauthorized pages or placeholders into their clipboard. The flaw arises because the system only checks permissions for the requesting user’s clipboard, ignoring validations on the source placeholder, thus potentially exposing sensitive text, link names, and URLs to unauthorized access.

References