CVE-2026-54622: django CMS: Clipboard copy IDOR discloses unauthorized plugin content
Summary The clipboard copy paths of the copyplugins admin endpoint validate only the target (the user's own clipboard) and skip source-side authorization. A staff user can copy plugins out of a placeholder they have no permission on into their clipboard, then read the (secret) content.
### Details In cms/admin/placeholderadmin.py, copyplugintoclipboard and copyplaceholdertoclipboard check hascopypluginspermission, which only evaluates request.toolbar.clipboard.hasaddpluginspermission(...) — the clipboard belongs to the requesting user, and checksource is likewise applied only to the clipboard. The source placeholder identified by the attacker-supplied sourceplaceholderid / sourcepluginid is never authorization-checked. (The placeholder-to-placeholder copy path, hascopyfromplaceholderpermission, correctly checks both sides.)
### Impact A staff user holding the global add permission for a plugin type, but with no access to a given placeholder/page, can copy that placeholder's plugins into their own clipboard and read content (e.g. link names/URLs, text) they cannot reach through the normal edit endpoints.
Requires CMSPERMISSION=True with per-placeholder/page restrictions.
### Patches Fixed in 5.0.8: the clipboard copy paths now also verify source-side permission (hasaddpluginspermission + checksource on the source placeholder), matching placeholder-to-placeholder copy.
### Workarounds None. Upgrade is recommended.
### Credits Reported by the security team at the University of Sydney ([@reporter]).
Other sources
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the copyplugins endpoint in cms/admin/placeholderadmin.py authorizes only the destination clipboard. The copyplugintoclipboard and copyplaceholdertoclipboard paths accept sourceplaceholderid and sourcepluginid values but use hascopypluginspermission and checksource only for the requesting user’s clipboard, without validating the source placeholder. Under CMSPERMISSION, a staff user with the global add permission for a plugin type can copy plugins from an unauthorized page or placeholder into the user’s clipboard and read secret text, link names, and URLs. This issue is fixed in versions 5.0.8.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/django-cmsto a version that resolves this vulnerability.Fixed in 5.0.8 - Upgrade
Upgrade
django CMSto a version that resolves this vulnerability.Fixed in 5.0.8Patch Fixed in 5.0.8
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Deployments using django CMS before 5.0.8 with CMS_PERMISSION enabled are affected when staff users have the global add permission for a plugin type. The issue concerns access to plugin content on pages or placeholders that those staff users are not authorized to view.
What does an attacker need to exploit it?
An attacker needs a staff account and the global add permission for the relevant plugin type. They can submit source_placeholder_id or source_plugin_id values for unauthorized content to the copy_plugins endpoint and copy that content into their own clipboard.
What information could be disclosed?
The affected copy operation can disclose plugin content, including secret text, link names, and URLs. The provided data describes an information-disclosure impact and does not describe integrity or availability impact.
How can I remediate the issue?
Upgrade django CMS to version 5.0.8, which fixes the source-placeholder authorization check. If immediate patching is not possible, restrict staff accounts' global add permissions for plugin types and limit access to accounts that must perform plugin-copy operations.