CVE Feed

    Dashboard / CVE / CVE-2026-54622

    CVE-2026-54622

    django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the copy_plugins endpoint in cms/admin/placeholderadmin.py authorizes only the destination clipboard. The _copy_plugin_to_clipboard and _copy_placeholder_to_clipboard paths accept source_placeholder_id and source_plugin_id values but use has_copy_plugins_permission and check_source only for the requesting user’s clipboard, without validating the source placeholder. Under CMS_PERMISSION, a staff user with the global add permission for a plugin type can copy plugins from an unauthorized page or placeholder into the user’s clipboard and read secret text, link names, and URLs. This issue is fixed in versions 5.0.8.

    Published:Aug 20, 2026
    Last Modified:Aug 20, 2026
    EPS:Aug 20, 2026
    EPSS Score:
    CVSS Score:6.5

    Affected Products

    Vendor
    Django-cms
    Product
    Django Cms

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-75526 (CVSS 4.4) — django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Fr…
    CVE-2026-63003 (CVSS 6.5) — django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Pr…
    CVE-2026-61663 (CVSS 4.3) — django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Pr…
    CVE-2026-54624 (CVSS 6.5) — django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Pr…
    CVE-2026-54623 (CVSS 7.1) — django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Pr…
    CVE-2026-54625 (CVSS 4.8) — django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS pag…
    CVE-2024-11319 (CVSS 4.8) — Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in d…
    CVE-2021-44649 (CVSS 5.4) — Django CMS 3.7.3 does not validate the plugin_type parameter while generating error messages for an invalid pl…
    CVE-2015-5081 (CVSS 8.8) — Cross-site request forgery (CSRF) vulnerability in django CMS before 3.0.14, 3.1.x before 3.1.1 allows remote …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High