Cache Vulnerability in django CMS Affects Content Delivery
CVE-2026-54625
4.8MEDIUM
What is CVE-2026-54625?
A vulnerability in django CMS's caching mechanism allows for potential content leakage between users. The page cache in versions before 5.0.8 and in 5.1.0a1 improperly handles request headers declared by plugins via the get_vary_cache_on() method. This results in the cache being served without considering essential header values, leading to scenarios where one user may receive content intended for another user. This flaw can be exploited by unauthenticated attackers to prime the cache with malicious content, thereby compromising user-specific data integrity. The issue has been rectified in subsequent releases.
Affected Version(s)
django-cms < 5.0.8 < 5.0.8
django-cms >= 5.1.0a1, < 5.1.0 < 5.1.0a1, 5.1.0