Description

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the copy_plugins endpoint in cms/admin/placeholderadmin.py authorizes only the destination clipboard. The _copy_plugin_to_clipboard and _copy_placeholder_to_clipboard paths accept source_placeholder_id and source_plugin_id values but use has_copy_plugins_permission and check_source only for the requesting user’s clipboard, without validating the source placeholder. Under CMS_PERMISSION, a staff user with the global add permission for a plugin type can copy plugins from an unauthorized page or placeholder into the user’s clipboard and read secret text, link names, and URLs. This issue is fixed in versions 5.0.8.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-20T19:16:55.333Z",
  "pubdate": "2026-08-20T19:16:55.333Z",
  "executiveSummary": "An authorization bypass vulnerability exists in the django CMS copy_plugins endpoint, specifically within cms/admin/placeholderadmin.py, prior to version 5.0.8.\nThe vulnerability allows an authenticated staff user to exploit insufficient access controls on source validation functions.\nBy leveraging global add permissions for a specific plugin type under CMS_PERMISSION, an attacker can copy plugins from unauthorized pages or placeholders directly into their personal clipboard.\nThe impact of successful exploitation includes the unauthorized disclosure of sensitive information, such as secret text, link names, and URLs contained within the targeted plugins.\nThe attack vector requires authenticated access and specific global permissions, but bypasses standard per-placeholder authorization checks.\nThe risk is mitigated by updating django CMS to version 5.0.8, which properly validates source placeholder permissions during the copy process.",
  "technicalDetails": "The vulnerability resides in the django CMS administrative backend, specifically within the copy_plugins endpoint located in cms/admin/placeholderadmin.py.\nThe affected code paths, _copy_plugin_to_clipboard and _copy_placeholder_to_clipboard, accept user-supplied parameters for source_placeholder_id and source_plugin_id.\nThe root cause of the issue is an incomplete authorization check. While the application validates permissions for the destination clipboard using has_copy_plugins_permission and check_source, it fails to perform equivalent authorization validation against the source placeholder ID provided in the request.\nUnder the CMS_PERMISSION authorization model, a malicious or overly privileged staff user who possesses global add permissions for a specific plugin type can initiate a copy operation targeting placeholders or pages they are explicitly forbidden from accessing.\nDuring the attack flow, the user submits a crafted request to the copy_plugins endpoint specifying an arbitrary source_placeholder_id or source_plugin_id.\nBecause the backend function omits the validation of the source object against the requesting user's permissions, the application processes the request and copies the restricted plugin content into the user's personal clipboard.\nPost-exploitation impact involves the unauthorized read access of confidential data stored within the copied plugins, including secret text strings, internal link names, and sensitive URLs.\nAffected versions include all django CMS installations prior to version 5.0.8. Exploitation requires standard administrative staff authentication and exploitation of the CMS_PERMISSION framework."
}