Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-61663 Details

Description

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, render_object_structure fails to authorize non-PageContent objects that use PlaceholderRelationField. An active staff user without cms.use_structure or model-level view or change permission can request the //admin/cms/placeholder/object/<content_type_id>/structure/<object_id>/ endpoint with guessed content_type_id and object_id values. The response discloses placeholder slot names, plugin trees, plugin identifiers, labels, and object existence for frontend-editable objects. The fix applies user_can_view_placeholder_source to the non-PageContent branch while keeping the structure board read-only for view-only users. This issue is fixed in versions 5.0.9.

Metrics

CVSS 3.x Severity and Vector Strings:

CNA: [email protected]CVSS-B:4.3 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/django-cms/django-cms/security/advisories/GHSA-8qj2-c6q4-f399	CISA-ADP
https://github.com/django-cms/django-cms/commit/9c82abfeb25471583e23906ea1ebef9202527b04	[email protected]
https://github.com/django-cms/django-cms/pull/8703	[email protected]
https://github.com/django-cms/django-cms/releases/tag/5.0.9	[email protected]
https://github.com/django-cms/django-cms/security/advisories/GHSA-8qj2-c6q4-f399	[email protected]

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-639	Authorization Bypass Through User-Controlled Key	[email protected]
CWE-862	Missing Authorization	[email protected]

Affected Products

No affected product data is available for this CVE.

Change History

2 change records found show changes

Date	Action	Recorded By
Aug 25, 2026	CVE Modified	CISA-ADP
Aug 20, 2026	New CVE Received	[email protected]