django CMS: Clipboard copy IDOR discloses unauthorized plugin content
Summary
The clipboard copy paths of the copy_plugins admin endpoint validate only the target (the user's own clipboard) and skip source-side authorization. A staff user can copy plugins out of a placeholder they have no permission on into their clipboard, then read the (secret) content.
Details
In cms/admin/placeholderadmin.py, _copy_plugin_to_clipboard and _copy_placeholder_to_clipboard check has_copy_plugins_permission, which only evaluates request.toolbar.clipboard.has_add_plugins_permission(...) — the
clipboard belongs to the requesting user, and check_source is likewise applied only to the clipboard. The source placeholder identified by the attacker-supplied source_placeholder_id / source_plugin_id is never authorization-checked. (The placeholder-to-placeholder copy path, has_copy_from_placeholder_permission, correctly checks both sides.)
Impact
A staff user holding the global add permission for a plugin type, but with no access to a given placeholder/page, can copy that placeholder's plugins into their own clipboard and read content (e.g. link names/URLs, text) they cannot reach through the normal edit endpoints.
Requires CMS_PERMISSION=True with per-placeholder/page restrictions.
Patches
Fixed in 5.0.8: the clipboard copy paths now also verify source-side permission (has_add_plugins_permission + check_source on the source placeholder), matching placeholder-to-placeholder copy.
Workarounds
None. Upgrade is recommended.
Credits
Reported by the security team at the University of Sydney ([@reporter]).
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | django-cms | < 5.0.8 | 5.0.8 |
References
- https://github.com/django-cms/django-cms/security/advisories/GHSA-4xfr-4p46-gc6p
- https://github.com/django-cms/django-cms/pull/8645
- https://github.com/django-cms/django-cms/commit/7642a98ab3170793c0b27b4125dd1f3d318b8a1c
- https://github.com/django-cms/django-cms
- https://github.com/django-cms/django-cms/releases/tag/5.0.8
- https://pypi.org/project/django-cms
- https://github.com/advisories/GHSA-4xfr-4p46-gc6p
- https://nvd.nist.gov/vuln/detail/CVE-2026-54622
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N- Weakness (CWE)
CWE-639- Platform
- Python (PyPI)
- Package
django-cms- Disclosed
- 20.08.2026
- Updated
- 11.10.2026 15:18
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-3820 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-4xfr-4p46-gc6p - CC BY 4.0
Vulnerability history: django-cms
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 10
- First → latest
- 08.2017 08.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 2
- Medium 8
Disclosures per year
- 2017: 1
- 2018: 0
- 2019: 0
- 2020: 0
- 2021: 0
- 2022: 1
- 2023: 0
- 2024: 1
- 2025: 0
- 2026: 7
-
django CMS: Clipboard copy IDOR discloses unauthorized plugin content this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.