CVE-2026-61663: django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff
(updated )
The django-cms frontend-editing structure endpoint
GET /<lang>/admin/cms/placeholder/object/<content_type_id>/structure/<object_id>/
did not perform an object-level authorization check for non-PageContent objects. Any authenticated, active staff user could request the structure endpoint for a frontend-editable object (a model using PlaceholderRelationField) and read its placeholder/plugin structure, even without permission to change that object and without the cms.use_structure permission that the toolbar UI requires before offering structure mode.
PageContent objects were already protected (a page-view check added in GHSA/PR #8644); this advisory covers the remaining non-PageContent branch of the same view.
References
- github.com/advisories/GHSA-8qj2-c6q4-f399
- github.com/django-cms/django-cms/commit/9c82abfeb25471583e23906ea1ebef9202527b04
- github.com/django-cms/django-cms/pull/8703
- github.com/django-cms/django-cms/releases/tag/5.0.9
- github.com/django-cms/django-cms/security/advisories/GHSA-8qj2-c6q4-f399
- nvd.nist.gov/vuln/detail/CVE-2026-61663
Code Behaviors & Features
Detect and mitigate CVE-2026-61663 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →