CVE-2026-61663: django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff
(updated )
The django-cms frontend-editing structure endpoint
GET /<lang>/admin/cms/placeholder/object/<content_type_id>/structure/<object_id>/
did not perform an object-level authorization check for non-PageContent objects. Any authenticated, active staff user could request the structure endpoint for a frontend-editable object (a model using PlaceholderRelationField) and read its placeholder/plugin structure, even without permission to change that object and without the cms.use_structure permission that the toolbar UI requires before offering structure mode.
PageContent objects were already protected (a page-view check added in GHSA/PR #8644); this advisory covers the remaining non-PageContent branch of the same view.
References
- github.com/advisories/GHSA-8qj2-c6q4-f399
- github.com/django-cms/django-cms/commit/9c82abfeb25471583e23906ea1ebef9202527b04
- github.com/django-cms/django-cms/pull/8703
- github.com/django-cms/django-cms/releases/tag/5.0.9
- github.com/django-cms/django-cms/security/advisories/GHSA-8qj2-c6q4-f399
- nvd.nist.gov/vuln/detail/CVE-2026-61663
Code Behaviors & Features
Detect and mitigate CVE-2026-61663 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →