{"id":"CVE-2026-61663","aliases":["EUVD-2026-63569","GHSA-8qj2-c6q4-f399","PYSEC-2026-3823"],"status":"published","title":"django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff","description":"django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, render_object_structure fails to authorize non-PageContent objects that use PlaceholderRelationField. An active staff user without cms.use_structure or model-level view or change permission can request the //admin/cms/placeholder/object/\u003ccontent_type_id\u003e/structure/\u003cobject_id\u003e/ endpoint with guessed content_type_id and object_id values. The response discloses placeholder slot names, plugin trees, plugin identifiers, labels, and object existence for frontend-editable objects. The fix applies user_can_view_placeholder_source to the non-PageContent branch while keeping the structure board read-only for view-only users. This issue is fixed in versions 5.0.9.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00342,"percentile":0.27946,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-639","CWE-862"],"published":"2026-08-20T18:07:28Z","modified":"2026-10-28T02:30:23Z","fixes":[{"ecosystem":"PyPI","package":"django-cms","fixed_in":["5.0.9"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"django-cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.9"}]}]},{"source":"osv","ecosystem":"PyPI","package":"django-cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.9"}]}],"versions":["2.0.1","2.0.2","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.2","2.2.1","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.4.0","2.4.1","2.4.2","2.4.3","3.0","3.0.1","3.0.10","3.0.11","3.0.12","3.0.13","3.0.14","3.0.15","3.0.16","3.0.17","3.0.18","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.0.b1","3.1.0rc1","3.1.0rc2","3.1.1","3.1.2","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.10.0","3.10.0rc1","3.10.0rc2","3.10.1","3.10.1rc1","3.11.0","3.11.1","3.11.10","3.11.11","3.11.1rc1","3.11.2","3.11.3","3.11.4","3.11.5","3.11.6","3.11.7","3.11.8","3.11.9","3.2.0","3.2.1","3.2.2","3.2.3","3.2.4","3.2.5","3.3.0","3.3.0rc2","3.3.0rc3","3.3.0rc4","3.3.1","3.3.2","3.3.3","3.3.4","3.4.0","3.4.1","3.4.2","3.4.3","3.4.4","3.4.5","3.4.6","3.4.7","3.5.0","3.5.1","3.5.2","3.5.3","3.5.4","3.6.0","3.6.0rc1","3.6.0rc3","3.6.1","3.7.0","3.7.0rc1","3.7.0rc2","3.7.1","3.7.2","3.7.3","3.7.4","3.8.0","3.8.0rc1","3.8.1","3.8.2","3.9.0","3.9.0rc1","3.9.0rc2","3.9.0rc3","4.1.0","4.1.0rc1","4.1.0rc2","4.1.0rc3","4.1.0rc4","4.1.0rc5","4.1.1","4.1.10","4.1.11","4.1.2","4.1.3","4.1.4","4.1.5","4.1.6","4.1.7","4.1.9","5.0.0","5.0.0a1","5.0.1","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8"]},{"source":"osv","ecosystem":"PyPI","package":"django-cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.9"}]}],"versions":["2.0.1","2.0.2","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.2","2.2.1","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.4.0","2.4.1","2.4.2","2.4.3","3.0","3.0.1","3.0.10","3.0.11","3.0.12","3.0.13","3.0.14","3.0.15","3.0.16","3.0.17","3.0.18","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.0.b1","3.1.0rc1","3.1.0rc2","3.1.1","3.1.2","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.10.0","3.10.0rc1","3.10.0rc2","3.10.1","3.10.1rc1","3.11.0","3.11.1","3.11.10","3.11.11","3.11.1rc1","3.11.2","3.11.3","3.11.4","3.11.5","3.11.6","3.11.7","3.11.8","3.11.9","3.2.0","3.2.1","3.2.2","3.2.3","3.2.4","3.2.5","3.3.0","3.3.0rc2","3.3.0rc3","3.3.0rc4","3.3.1","3.3.2","3.3.3","3.3.4","3.4.0","3.4.1","3.4.2","3.4.3","3.4.4","3.4.5","3.4.6","3.4.7","3.5.0","3.5.1","3.5.2","3.5.3","3.5.4","3.6.0","3.6.0rc1","3.6.0rc3","3.6.1","3.7.0","3.7.0rc1","3.7.0rc2","3.7.1","3.7.2","3.7.3","3.7.4","3.8.0","3.8.0rc1","3.8.1","3.8.2","3.9.0","3.9.0rc1","3.9.0rc2","3.9.0rc3","4.1.0","4.1.0rc1","4.1.0rc2","4.1.0rc3","4.1.0rc4","4.1.0rc5","4.1.1","4.1.10","4.1.11","4.1.2","4.1.3","4.1.4","4.1.5","4.1.6","4.1.7","4.1.9","5.0.0","5.0.0a1","5.0.1","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8"]}],"products":[{"vendor":"django cms association","product":"django-cms"},{"vendor":"django-cms","product":"django-cms"}],"references":[{"url":"https://github.com/django-cms/django-cms/security/advisories/GHSA-8qj2-c6q4-f399","tags":["x_refsource_CONFIRM","exploit","advisory","web"]},{"url":"https://github.com/django-cms/django-cms/pull/8703","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/django-cms/django-cms/commit/9c82abfeb25471583e23906ea1ebef9202527b04","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/django-cms/django-cms/releases/tag/5.0.9","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-8qj2-c6q4-f399","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61663.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61663","tags":["advisory"]},{"url":"https://github.com/django-cms/django-cms","tags":["package"]},{"url":"https://pypi.org/project/django-cms","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-61663","title":"django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff","description":"django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, render_object_structure fails to authorize non-PageContent objects that use PlaceholderRelationField. An active staff user without cms.use_structure or model-level view or change permission can request the //admin/cms/placeholder/object/\u003ccontent_type_id\u003e/structure/\u003cobject_id\u003e/ endpoint with guessed content_type_id and object_id values. The response discloses placeholder slot names, plugin trees, plugin identifiers, labels, and object existence for frontend-editable objects. The fix applies user_can_view_placeholder_source to the non-PageContent branch while keeping the structure board read-only for view-only users. This issue is fixed in versions 5.0.9.","status":"published","published":"2026-08-20T18:07:28.005Z","modified":"2026-08-25T15:16:01.718Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-639","CWE-862"],"updated_at":"2026-11-02T14:19:53.786088Z"}],"euvd":[{"id":"EUVD-2026-63569","description":"django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, render_object_structure fails to authorize non-PageContent objects that use PlaceholderRelationField. An active staff user without cms.use_structure or model-level view or change permission can request the //admin/cms/placeholder/object/\u003ccontent_type_id\u003e/structure/\u003cobject_id\u003e/ endpoint with guessed content_type_id and object_id values. The response discloses placeholder slot names, plugin trees, plugin identifiers, labels, and object existence for frontend-editable objects. The fix applies user_can_view_placeholder_source to the non-PageContent branch while keeping the structure board read-only for view-only users. This issue is fixed in versions 5.0.9.","status":"published","published":"2026-08-20T18:07:28Z","modified":"2026-08-25T15:16:01Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T18:01:32.513581Z"}],"ghsa":[{"id":"GHSA-8qj2-c6q4-f399","title":"django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff","description":"## Summary\n\nThe django-cms frontend-editing structure endpoint\n\n```\nGET /\u003clang\u003e/admin/cms/placeholder/object/\u003ccontent_type_id\u003e/structure/\u003cobject_id\u003e/\n```\n\ndid not perform an object-level authorization check for **non-`PageContent`** objects. Any authenticated, active staff user could request the structure endpoint for a frontend-editable object (a model using `PlaceholderRelationField`) and read its placeholder/plugin structure, even without permission to change that object and without the `cms.use_structure` permission that the toolbar UI requires before offering structure mode.\n\n`PageContent` objects were already protected (a page-view check added in GHSA/PR #8644); this advisory covers the remaining non-`PageContent` branch of the same view.\n\n## Severity\n\nThe issue is staff-gated and read-only, disclosing CMS structure metadata (placeholder slot names, plugin tree, plugin identifiers/labels, object existence) rather than write access or arbitrary field data.\n\n## Affected versions\n\n- django-cms `\u003e= 4.0.0, \u003c= 5.0.x` and `5.1.0a1`\n  (the vulnerable non-`PageContent` branch was introduced with the frontend-editing endpoints in 4.0)\n\n## Patched versions\n\n- django-cms TODO: 5.0.9\n\n## Preconditions\n\n- An authenticated, active staff account (`is_staff=True`).\n- The deployment exposes a non-`PageContent` model with django-cms placeholders / frontend editing (e.g. via `PlaceholderRelationField`).\n- The attacker can guess or enumerate the target `content_type_id` and object id.\n- The attacker needs **no** model/object change permission and **no** `cms.use_structure` permission.\n\n## Impact\n\nA low-privileged staff user can read the editorial placeholder/plugin structure of non-`PageContent` objects they are not authorized to edit through the toolbar. Depending on the installed plugins and templates this may reveal placeholder names, plugin layout, plugin identifiers and the existence of objects owned by other staff users or teams. This is most relevant for deployments using third-party or custom django-cms apps that expose frontend-editable objects outside the page tree.\n\n## Proof of concept\n\nUsing django-cms' own test model `placeholder_relation_field_app.FancyPoll` (a non-`PageContent` model with a `PlaceholderRelationField`):\n\n```python\ntarget = FancyPoll.objects.create(name=\"private-fancy-poll\")\nplaceholder = rescan_placeholders_for_obj(target)[\"content\"]\nattacker = self._create_user(\"low_staff\", is_staff=True, is_superuser=False)\n# attacker has neither change_fancypoll nor cms.use_structure\n\nwith self.login_user_context(attacker):\n    response = self.client.get(get_object_structure_url(target, language=\"en\"))\n\n# Before fix: HTTP 200, body contains '\"placeholder_id\": \"\u003cpk\u003e\"'\n# After fix:  HTTP 404, structure not disclosed\n```\n\n## Patch\n\n`render_object_structure` now authorizes the non-`PageContent` branch, mirroring\n`Placeholder.has_change_permission` at the object level (honouring a custom\n`has_placeholder_change_permission` hook, otherwise falling back to the model/object\nchange permission) and returning `404` when the user is not authorized:\n\n```python\nelse:\n    content_type_obj = content_type.get_object_for_this_type(pk=object_id)\n    if not _can_change_placeholder_object(request.user, content_type_obj):\n        raise Http404\n```\n\n## Workarounds\n\nNo configuration workaround. Deployments that do not register any non-`PageContent`\nfrontend-editable model are not affected. Otherwise, upgrade to a patched release.\n\n## Credit\n\nReported by **doanmanhducz**.","status":"published","published":"2026-08-20T18:42:50Z","modified":"2026-09-04T19:30:04Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-639","CWE-862"],"updated_at":"2026-11-02T14:41:12.487077Z"}],"nvd":[{"id":"CVE-2026-61663","description":"django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, render_object_structure fails to authorize non-PageContent objects that use PlaceholderRelationField. An active staff user without cms.use_structure or model-level view or change permission can request the //admin/cms/placeholder/object/\u003ccontent_type_id\u003e/structure/\u003cobject_id\u003e/ endpoint with guessed content_type_id and object_id values. The response discloses placeholder slot names, plugin trees, plugin identifiers, labels, and object existence for frontend-editable objects. The fix applies user_can_view_placeholder_source to the non-PageContent branch while keeping the structure board read-only for view-only users. This issue is fixed in versions 5.0.9.","status":"published","published":"2026-08-20T19:16:56.823Z","modified":"2026-10-26T10:10:00.14Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-639","CWE-862"],"updated_at":"2026-11-02T14:12:40.302911Z"}],"osv":[{"id":"CVE-2026-61663","title":"django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff","description":"django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, render_object_structure fails to authorize non-PageContent objects that use PlaceholderRelationField. An active staff user without cms.use_structure or model-level view or change permission can request the //admin/cms/placeholder/object/\u003ccontent_type_id\u003e/structure/\u003cobject_id\u003e/ endpoint with guessed content_type_id and object_id values. The response discloses placeholder slot names, plugin trees, plugin identifiers, labels, and object existence for frontend-editable objects. The fix applies user_can_view_placeholder_source to the non-PageContent branch while keeping the structure board read-only for view-only users. This issue is fixed in versions 5.0.9.","status":"published","published":"2026-08-20T18:07:28.005Z","modified":"2026-10-28T02:30:23.663739731Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-639","CWE-862"],"updated_at":"2026-11-02T15:45:12.933503Z"},{"id":"GHSA-8qj2-c6q4-f399","title":"django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff","description":"## Summary\n\nThe django-cms frontend-editing structure endpoint\n\n```\nGET /\u003clang\u003e/admin/cms/placeholder/object/\u003ccontent_type_id\u003e/structure/\u003cobject_id\u003e/\n```\n\ndid not perform an object-level authorization check for **non-`PageContent`** objects. Any authenticated, active staff user could request the structure endpoint for a frontend-editable object (a model using `PlaceholderRelationField`) and read its placeholder/plugin structure, even without permission to change that object and without the `cms.use_structure` permission that the toolbar UI requires before offering structure mode.\n\n`PageContent` objects were already protected (a page-view check added in GHSA/PR #8644); this advisory covers the remaining non-`PageContent` branch of the same view.\n\n## Severity\n\nThe issue is staff-gated and read-only, disclosing CMS structure metadata (placeholder slot names, plugin tree, plugin identifiers/labels, object existence) rather than write access or arbitrary field data.\n\n## Affected versions\n\n- django-cms `\u003e= 4.0.0, \u003c= 5.0.x` and `5.1.0a1`\n  (the vulnerable non-`PageContent` branch was introduced with the frontend-editing endpoints in 4.0)\n\n## Patched versions\n\n- django-cms TODO: 5.0.9\n\n## Preconditions\n\n- An authenticated, active staff account (`is_staff=True`).\n- The deployment exposes a non-`PageContent` model with django-cms placeholders / frontend editing (e.g. via `PlaceholderRelationField`).\n- The attacker can guess or enumerate the target `content_type_id` and object id.\n- The attacker needs **no** model/object change permission and **no** `cms.use_structure` permission.\n\n## Impact\n\nA low-privileged staff user can read the editorial placeholder/plugin structure of non-`PageContent` objects they are not authorized to edit through the toolbar. Depending on the installed plugins and templates this may reveal placeholder names, plugin layout, plugin identifiers and the existence of objects owned by other staff users or teams. This is most relevant for deployments using third-party or custom django-cms apps that expose frontend-editable objects outside the page tree.\n\n## Proof of concept\n\nUsing django-cms' own test model `placeholder_relation_field_app.FancyPoll` (a non-`PageContent` model with a `PlaceholderRelationField`):\n\n```python\ntarget = FancyPoll.objects.create(name=\"private-fancy-poll\")\nplaceholder = rescan_placeholders_for_obj(target)[\"content\"]\nattacker = self._create_user(\"low_staff\", is_staff=True, is_superuser=False)\n# attacker has neither change_fancypoll nor cms.use_structure\n\nwith self.login_user_context(attacker):\n    response = self.client.get(get_object_structure_url(target, language=\"en\"))\n\n# Before fix: HTTP 200, body contains '\"placeholder_id\": \"\u003cpk\u003e\"'\n# After fix:  HTTP 404, structure not disclosed\n```\n\n## Patch\n\n`render_object_structure` now authorizes the non-`PageContent` branch, mirroring\n`Placeholder.has_change_permission` at the object level (honouring a custom\n`has_placeholder_change_permission` hook, otherwise falling back to the model/object\nchange permission) and returning `404` when the user is not authorized:\n\n```python\nelse:\n    content_type_obj = content_type.get_object_for_this_type(pk=object_id)\n    if not _can_change_placeholder_object(request.user, content_type_obj):\n        raise Http404\n```\n\n## Workarounds\n\nNo configuration workaround. Deployments that do not register any non-`PageContent`\nfrontend-editable model are not affected. Otherwise, upgrade to a patched release.\n\n## Credit\n\nReported by **doanmanhducz**.","status":"published","published":"2026-08-20T18:42:50Z","modified":"2026-09-10T12:25:51.292752883Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-639","CWE-862"],"updated_at":"2026-11-02T15:46:42.78452Z"},{"id":"PYSEC-2026-3823","title":"django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff","description":"## Summary\n\nThe django-cms frontend-editing structure endpoint\n\n```\nGET /\u003clang\u003e/admin/cms/placeholder/object/\u003ccontent_type_id\u003e/structure/\u003cobject_id\u003e/\n```\n\ndid not perform an object-level authorization check for **non-`PageContent`** objects. Any authenticated, active staff user could request the structure endpoint for a frontend-editable object (a model using `PlaceholderRelationField`) and read its placeholder/plugin structure, even without permission to change that object and without the `cms.use_structure` permission that the toolbar UI requires before offering structure mode.\n\n`PageContent` objects were already protected (a page-view check added in GHSA/PR #8644); this advisory covers the remaining non-`PageContent` branch of the same view.\n\n## Severity\n\nThe issue is staff-gated and read-only, disclosing CMS structure metadata (placeholder slot names, plugin tree, plugin identifiers/labels, object existence) rather than write access or arbitrary field data.\n\n## Affected versions\n\n- django-cms `\u003e= 4.0.0, \u003c= 5.0.x` and `5.1.0a1`\n  (the vulnerable non-`PageContent` branch was introduced with the frontend-editing endpoints in 4.0)\n\n## Patched versions\n\n- django-cms TODO: 5.0.9\n\n## Preconditions\n\n- An authenticated, active staff account (`is_staff=True`).\n- The deployment exposes a non-`PageContent` model with django-cms placeholders / frontend editing (e.g. via `PlaceholderRelationField`).\n- The attacker can guess or enumerate the target `content_type_id` and object id.\n- The attacker needs **no** model/object change permission and **no** `cms.use_structure` permission.\n\n## Impact\n\nA low-privileged staff user can read the editorial placeholder/plugin structure of non-`PageContent` objects they are not authorized to edit through the toolbar. Depending on the installed plugins and templates this may reveal placeholder names, plugin layout, plugin identifiers and the existence of objects owned by other staff users or teams. This is most relevant for deployments using third-party or custom django-cms apps that expose frontend-editable objects outside the page tree.\n\n## Proof of concept\n\nUsing django-cms' own test model `placeholder_relation_field_app.FancyPoll` (a non-`PageContent` model with a `PlaceholderRelationField`):\n\n```python\ntarget = FancyPoll.objects.create(name=\"private-fancy-poll\")\nplaceholder = rescan_placeholders_for_obj(target)[\"content\"]\nattacker = self._create_user(\"low_staff\", is_staff=True, is_superuser=False)\n# attacker has neither change_fancypoll nor cms.use_structure\n\nwith self.login_user_context(attacker):\n    response = self.client.get(get_object_structure_url(target, language=\"en\"))\n\n# Before fix: HTTP 200, body contains '\"placeholder_id\": \"\u003cpk\u003e\"'\n# After fix:  HTTP 404, structure not disclosed\n```\n\n## Patch\n\n`render_object_structure` now authorizes the non-`PageContent` branch, mirroring\n`Placeholder.has_change_permission` at the object level (honouring a custom\n`has_placeholder_change_permission` hook, otherwise falling back to the model/object\nchange permission) and returning `404` when the user is not authorized:\n\n```python\nelse:\n    content_type_obj = content_type.get_object_for_this_type(pk=object_id)\n    if not _can_change_placeholder_object(request.user, content_type_obj):\n        raise Http404\n```\n\n## Workarounds\n\nNo configuration workaround. Deployments that do not register any non-`PageContent`\nfrontend-editable model are not affected. Otherwise, upgrade to a patched release.\n\n## Credit\n\nReported by **doanmanhducz**.","status":"published","published":"2026-09-10T09:44:52.754662Z","modified":"2026-09-10T12:15:04.98902312Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:57.255153Z"}]}}