Description

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, render_object_structure fails to authorize non-PageContent objects that use PlaceholderRelationField. An active staff user without cms.use_structure or model-level view or change permission can request the //admin/cms/placeholder/object/<content_type_id>/structure/<object_id>/ endpoint with guessed content_type_id and object_id values. The response discloses placeholder slot names, plugin trees, plugin identifiers, labels, and object existence for frontend-editable objects. The fix applies user_can_view_placeholder_source to the non-PageContent branch while keeping the structure board read-only for view-only users. This issue is fixed in versions 5.0.9.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-20T19:16:56.823Z",
  "pubdate": "2026-08-20T19:16:56.823Z",
  "executiveSummary": "An authorization bypass vulnerability exists in django CMS prior to version 5.0.9 within the render_object_structure functionality. The flaw allows authenticated active staff users lacking both the cms.use_structure permission and model-level view or change permissions to improperly access sensitive data regarding non-PageContent objects utilizing the PlaceholderRelationField. By querying the administration endpoint with guessed content_type_id and object_id parameters, attackers can enumerate object existence and harvest confidential architectural data, including placeholder slot names, plugin trees, plugin identifiers, and labels associated with frontend-editable objects. This information disclosure poses a moderate risk to application confidentiality by exposing internal content management structures to unauthorized staff principals.",
  "technicalDetails": "The root cause of the vulnerability resides in the access control logic implemented within the render_object_structure function of django CMS. Specifically, the application fails to properly authorize non-PageContent objects that rely on the PlaceholderRelationField during structure rendering requests. The vulnerable component is exposed via the administrative routing endpoint located at //admin/cms/placeholder/object/<content_type_id>/structure/<object_id>/.\nExploitation requires an active staff user account, representing an authenticated internal threat actor or an attacker who has compromised low-privileged staff credentials. However, the attacker does not require the cms.use_structure capability nor model-level view or change permissions over the targeted objects. The attack flow involves the adversary systematically or deterministically guessing valid content_type_id and object_id numerical values and issuing direct HTTP GET or POST requests to the structure endpoint.\nUpon receiving the request, the flawed authorization check fails to enforce user_can_view_placeholder_source against the non-PageContent branch. As a result, the server processes the request and returns a detailed structural response. The payload and resulting output disclose critical metadata, encompassing placeholder slot names, complete plugin trees, distinct plugin identifiers, human-readable labels, and confirmation of object existence for frontend-editable entities. Post-exploitation impact is characterized by unauthorized information disclosure, enabling reconnaissance against the content management infrastructure to identify further potential high-value targets or misconfigurations for subsequent attacks."
}