PT-2026-80254 · Pypi · Django Cms

Published

2026-08-20

·

Updated

2026-08-20

CVSS v3.1

4.3

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Summary

The django-cms frontend-editing structure endpoint
GET /<lang>/admin/cms/placeholder/object/<content type id>/structure/<object id>/
did not perform an object-level authorization check for non-PageContent objects. Any authenticated, active staff user could request the structure endpoint for a frontend-editable object (a model using PlaceholderRelationField) and read its placeholder/plugin structure, even without permission to change that object and without the cms.use structure permission that the toolbar UI requires before offering structure mode.
PageContent objects were already protected (a page-view check added in GHSA/PR #8644); this advisory covers the remaining non-PageContent branch of the same view.

Severity

The issue is staff-gated and read-only, disclosing CMS structure metadata (placeholder slot names, plugin tree, plugin identifiers/labels, object existence) rather than write access or arbitrary field data.

Affected versions

  • django-cms >= 4.0.0, <= 5.0.x and 5.1.0a1 (the vulnerable non-PageContent branch was introduced with the frontend-editing endpoints in 4.0)

Patched versions

  • django-cms TODO: 5.0.9

Preconditions

  • An authenticated, active staff account (is staff=True).
  • The deployment exposes a non-PageContent model with django-cms placeholders / frontend editing (e.g. via PlaceholderRelationField).
  • The attacker can guess or enumerate the target content type id and object id.
  • The attacker needs no model/object change permission and no cms.use structure permission.

Impact

A low-privileged staff user can read the editorial placeholder/plugin structure of non-PageContent objects they are not authorized to edit through the toolbar. Depending on the installed plugins and templates this may reveal placeholder names, plugin layout, plugin identifiers and the existence of objects owned by other staff users or teams. This is most relevant for deployments using third-party or custom django-cms apps that expose frontend-editable objects outside the page tree.

Proof of concept

Using django-cms' own test model placeholder relation field app.FancyPoll (a non-PageContent model with a PlaceholderRelationField):
python
target = FancyPoll.objects.create(name="private-fancy-poll")
placeholder = rescan placeholders for obj(target)["content"]
attacker = self. create user("low staff", is staff=True, is superuser=False)
# attacker has neither change fancypoll nor cms.use structure

with self.login user context(attacker):
  response = self.client.get(get object structure url(target, language="en"))

# Before fix: HTTP 200, body contains '"placeholder id": "<pk>"'
# After fix: HTTP 404, structure not disclosed

Patch

render object structure now authorizes the non-PageContent branch, mirroring Placeholder.has change permission at the object level (honouring a custom has placeholder change permission hook, otherwise falling back to the model/object change permission) and returning 404 when the user is not authorized:
python
else:
  content type obj = content type.get object for this type(pk=object id)
  if not can change placeholder object(request.user, content type obj):
    raise Http404

Workarounds

No configuration workaround. Deployments that do not register any non-PageContent frontend-editable model are not affected. Otherwise, upgrade to a patched release.

Credit

Reported by doanmanhducz.

Fix

Missing Authorization

IDOR

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-862CWE-639

Related Identifiers

GHSA-8QJ2-C6Q4-F399

Affected Products

Django Cms