Security Advisory

CVE-2026-54624

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-08-20 18:04:38

Last updated 2026-08-20 19:46:10

Assigner GitHub_M

CVSS score 6.5

State PUBLISHED

Description

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, render_object_structure in cms/views.py renders cms/toolbar/structure.html for a PageContent object without calling user_can_view_page(). Any staff account can request a restricted page’s structure when CMS_PERMISSION is enabled and the page has view restrictions or CMS_PUBLIC_FOR is set to staff. The response exposes plugin get_short_description() values, including link names, URLs, and text snippets, rather than only the page shape. This issue is fixed in versions 5.0.8.

← Browse all CVEs View on cve.org ↗