CVE-2026-54625

Name of the Vulnerable Software and Affected Versions django CMS versions prior to 5.0.8 django CMS version 5.1.0a1

Description The page cache in cms/cache/page.py ignores request headers declared by plugins through the get vary cache on() function. While the page cache key function includes the cache prefix, site, language, path, and timezone, it fails to include the declared header values. Consequently, although set page cache adds these names to the response Vary header, get page cache retrieves the first stored variant under the same header-agnostic key. When CMS PAGE CACHE is enabled and a plugin varies content based on a header such as Country-Code, a visitor may receive content intended for another user, and an unauthenticated attacker can prime the cache with content of their choosing.

Recommendations Update to version 5.0.8. Update to version 5.1.0. As a temporary mitigation, consider disabling CMS PAGE CACHE to prevent the delivery of incorrect cached content.