Authorization Flaw in django CMS Page Duplication Affects Multiple Versions

CVE-2026-63003

What is CVE-2026-63003?

In django CMS, prior to version 5.0.9, an authorization vulnerability exists during the page duplication process. Specifically, the framework does not enforce object-level authorization checks on the source page. This oversight allows a malicious actor to duplicate content from unauthorized pages, effectively bypassing intended access restrictions. The DuplicatePageForm and AddPageForm do not validate user permissions appropriately, resulting in potential exposure of sensitive content. This issue is mitigated in version 5.0.9, which addresses these security gaps by implementing necessary authorization checks.

References