Authorization Flaw in django CMS Affects Placeholder Relations

CVE-2026-61663

What is CVE-2026-61663?

An authorization flaw in django CMS before version 5.0.9 affects the render_object_structure function, allowing active staff users lacking cms.use_structure permissions to query certain endpoints. By manipulating content_type_id and object_id values, users can access sensitive data, such as placeholder slot names and plugin identifiers, which may compromise frontend-editable objects. A patch has been implemented in version 5.0.9 to restrict unauthorized views while keeping the structure board read-only for those with view-only permissions.

References