CVE-2026-54622

Name of the Vulnerable Software and Affected Versions django CMS versions prior to 5.0.8

Description The copy plugins endpoint in cms/admin/placeholderadmin.py authorizes only the destination clipboard. The copy plugin to clipboard and copy placeholder to clipboard paths accept source placeholder id and source plugin id values but use has copy plugins permission and check source only for the requesting user’s clipboard, without validating the source placeholder. Under CMS PERMISSION, a staff user with the global add permission for a plugin type can copy plugins from an unauthorized page or placeholder into the user’s clipboard to read secret text, link names, and URLs.

Recommendations Update to version 5.0.8.