CVE-2026-54624

Name of the Vulnerable Software and Affected Versions django CMS versions prior to 5.0.8

Description The render object structure function in cms/views.py renders cms/toolbar/structure.html for a PageContent object without verifying permissions via the user can view page() function. When CMS PERMISSION is enabled and a page has view restrictions, or when CMS PUBLIC FOR is set to staff, any staff account can request the structure of a restricted page. This results in the exposure of get short description() values from plugins, which may include URLs, link names, and text snippets, instead of only revealing the page shape.

Recommendations Update django CMS to version 5.0.8.