AIKIDO-2026-901803
django-cms is vulnerable to Privilege Escalation
72
High Risk
This Affects:
django-cmsTL;DR
When the CMS permission system is enabled, get_subordinate_users() returns every user, including superusers, to any user at the top of the delegation hierarchy, so superuser PageUser records appear in the delegated user admin. Django's separate change-password endpoint only checks has_change_permission, which incorrectly treats the superuser as a subordinate, so a delegated administrator can reset a superuser's password and log in as that account. This escalates a scoped delegated administrator into a full site administrator with complete control over the Django admin and every model mounted in it. The fix excludes superusers from subordinate querysets and adds object-level and password-change guards in the page user admin.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you run with CMS_PERMISSION = True and have a superuser registered as a PageUser record.
Background info
django-cms is vulnerable to Privilege Escalation in versions 3.0.0 - 5.0.9 and 5.1.0 - 5.1.0.
How to fix this
Upgrade the django-cms library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant