AIKIDO-2026-700291
django-cms is vulnerable to Missing Authorization
43
Medium Risk
This Affects:
django-cmsTL;DR
The frontend-editing structure endpoint served by render_object_structure performs an object-level authorization check for PageContent objects but not for other frontend-editable models using PlaceholderRelationField. Any authenticated, active staff user can request the structure URL for a non-PageContent object and read its placeholder and plugin structure without change permission and without the cms.use_structure permission. This discloses placeholder slot names, the plugin tree, plugin identifiers, and object existence for objects the user is not authorized to edit. The fix authorizes the non-PageContent branch and returns 404 when the user is not permitted to view the object's placeholder source.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your deployment exposes non-PageContent frontend-editable models via PlaceholderRelationField.
Background info
django-cms is vulnerable to Missing Authorization in versions 4.1.0 - 5.0.8.
How to fix this
Upgrade the django-cms library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.