CVE-2026-61663

Name of the Vulnerable Software and Affected Versions django CMS versions prior to 5.0.9

Description The render object structure function fails to properly authorize non-PageContent objects that utilize PlaceholderRelationField. An active staff user lacking cms.use structure or model-level view or change permissions can access the //admin/cms/placeholder/object/<content type id>/structure/<object id>/ endpoint by guessing the content type id and object id values. This allows the user to disclose placeholder slot names, plugin trees, plugin identifiers, labels, and the existence of objects for frontend-editable objects.

Recommendations Update to version 5.0.9.