Vulnerability in django CMS Affects Page Content Access

CVE-2026-54624

What is CVE-2026-54624?

The django CMS framework has a vulnerability that allows unauthorized staff accounts to access restricted page structure information. Specifically, prior to version 5.0.8, the method render_object_structure in cms/views.py fails to properly enforce view permissions on certain pages. As a result, when CMS_PERMISSION is enabled, staff users can view sensitive data such as plugin names, URLs, and text snippets rather than just the layout of the pages. This flaw poses a risk of revealing critical information that should be kept secure. The issue is resolved in django CMS version 5.0.8.

References