CVE-2026-54623

Name of the Vulnerable Software and Affected Versions django CMS versions prior to 5.0.8

Description The 'move plugin' endpoint in 'cms/admin/placeholderadmin.py' fails to validate the plugin parent value, allowing a staff user with plugin-change permissions to assign a plugin's own identifier or a descendant's identifier as its parent. This creates a parent id cycle within the plugin tree. Because the get descendants cte and get ancestors cte queries in 'cms/models/pluginmodel.py' lack a cycle guard, the get descendants() function and subsequent rendering, copy, or delete operations may recurse indefinitely or hit database recursion limits. This can lead to tree corruption and the exhaustion of request workers.

Recommendations Update to version 5.0.8.