Description

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, render_object_structure in cms/views.py renders cms/toolbar/structure.html for a PageContent object without calling user_can_view_page(). Any staff account can request a restricted page’s structure when CMS_PERMISSION is enabled and the page has view restrictions or CMS_PUBLIC_FOR is set to staff. The response exposes plugin get_short_description() values, including link names, URLs, and text snippets, rather than only the page shape. This issue is fixed in versions 5.0.8.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-20T19:16:55.583Z",
  "pubdate": "2026-08-20T19:16:55.583Z",
  "executiveSummary": "An authorization bypass vulnerability exists within django CMS prior to version 5.0.8, specifically within the render_object_structure function located in cms/views.py. The vulnerability arises from an improper access control check where the application renders the cms/toolbar/structure.html template for a PageContent object without invoking the user_can_view_page() validation function.\nThe primary impact of this flaw is unauthorized information disclosure. When CMS_PERMISSION is enabled and target pages enforce view restrictions or CMS_PUBLIC_FOR is configured to staff, authenticated staff accounts can request and retrieve the structure of restricted pages to which they should not normally have access.\nAn attacker possessing standard staff-level privileges can exploit this flaw to harvest sensitive operational intelligence, including plugin get_short_description() return values, internal link names, destination URLs, and confidential text snippets exposed within the page structure response.\nMitigation requires upgrading django CMS to version 5.0.8 or later, where proper view restriction enforcement via user_can_view_page() has been restored to the structure rendering logic.",
  "technicalDetails": "The vulnerability resides in the render_object_structure function implemented within cms/views.py of the django CMS application. The root cause is an authorization oversight during the handling of structure rendering requests for PageContent objects.\nUnder expected security parameters—specifically when CMS_PERMISSION is enabled and pages feature explicit view restrictions or the CMS_PUBLIC_FOR parameter is set to restrict access to staff—the application must validate whether the requesting user possesses explicit permissions to view the specified page via the user_can_view_page() function.\nIn affected versions prior to 5.0.8, the render_object_structure function bypasses this crucial authorization check before rendering the cms/toolbar/structure.html template. Consequently, the request processing pipeline assumes structural inspection requests do not require the same granular view verification as standard page rendering operations.\nThe attack flow proceeds as follows: 1) An authenticated adversary authenticated as a standard staff account identifies or guesses the target identifier of a restricted page. 2) The attacker issues a crafted HTTP request targeting the structure view endpoint handled by render_object_structure. 3) The backend processes the request for the specified PageContent object, omitting the user_can_view_page() validation step. 4) The application serializes and returns the structure payload using cms/toolbar/structure.html. 5) The resulting HTTP response exposes sensitive plugin metadata, specifically the values returned by plugin get_short_description() methods.\nThe exposed data payload includes internal link identifiers, fully qualified URLs, and proprietary text snippets embedded within the plugins of the restricted page. This leaks structural intelligence and confidential content that should remain hidden from unauthorized staff members.\nPrerequisites for exploitation include an active authenticated session with standard staff privileges, network access to the administrative or frontend structure endpoints, and an environment where CMS_PERMISSION is active alongside page-level view restrictions or restrictive CMS_PUBLIC_FOR configurations."
}