Description

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, page duplication lacks an object-level authorization check on the source page. In cms/admin/forms.py, DuplicatePageForm.source accepts any Page, the AddPageForm constructor does not narrow a hidden source field, AddPageForm.clean does not validate the source against the user, and AddPageForm.save calls from_source. In cms/admin/pageadmin.py, duplicate and PageAdmin.has_add_permission check only whether a staff user may add a page. A crafted source value can therefore copy every placeholder and plugin from an unauthorized page with permissions=False, stripping source view restrictions and exposing content across sites or restricted subtrees when CMS_PERMISSION is enabled. This issue is fixed in versions 5.0.9.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-20T19:16:57.163Z",
  "pubdate": "2026-08-20T19:16:57.163Z",
  "executiveSummary": "An authorization bypass vulnerability exists in django CMS prior to version 5.0.9, specifically involving page duplication functionality.\nThe vulnerability allows an authenticated staff user to copy content, placeholders, and plugins from unauthorized source pages where they lack permissions.\nThe root cause stems from a missing object-level authorization check on the source page during the duplication process when CMS_PERMISSION is enabled.\nAttackers can supply a crafted source value to bypass view restrictions and expose sensitive content across sites or restricted subtrees.\nExploitation requires staff user privileges and the ability to interact with the page duplication form interface.\nThe risk implication includes unauthorized data exposure and privilege escalation regarding content visibility within the enterprise content management system.",
  "technicalDetails": "The vulnerability resides in the page duplication mechanism of django CMS, specifically within the cms/admin/forms.py and cms/admin/pageadmin.py files.\nIn cms/admin/forms.py, the DuplicatePageForm.source field accepts any Page object, and the AddPageForm constructor fails to narrow a hidden source field.\nFurthermore, AddPageForm.clean does not validate the source page against the requesting user's permissions, and AddPageForm.save proceeds to invoke from_source.\nIn cms/admin/pageadmin.py, the duplicate function and PageAdmin.has_add_permission check only whether a generic staff user possesses the general ability to add a page, neglecting object-level authorization on the source page itself.\nWhen CMS_PERMISSION is enabled, an attacker can manipulate the source value during the page addition and duplication workflow.\nStep-by-step attack flow involves an authenticated staff user initiating a page duplication request while supplying a crafted identifier for a target source page where permissions=False for that user.\nBecause validation checks are absent in AddPageForm.clean and object-level checks are omitted in PageAdmin, the application processes the duplication request.\nThe system copies every placeholder and plugin from the unauthorized source page, effectively stripping source view restrictions.\nThis behavior exposes restricted content across sites or within protected subtrees to users who should otherwise be denied access.\nAffected versions include all django CMS deployments prior to 5.0.9."
}