CVE-2026-54624: django CMS: Structure endpoint bypasses page-view permission
Summary The structure-board endpoint (renderobjectstructure) renders a page's plugin structure without verifying that the requesting user is allowed to view the page. The edit and preview endpoints enforce this via renderpage(), but the structure endpoint does not, allowing a low-privileged staff user to read the plugin structure of a view-restricted page.
Details renderobjectstructure (in cms/views.py) loads the PageContent object and renders cms/toolbar/structure.html directly. Unlike renderobjectendpoint (used by edit/preview), which renders through renderpagecontent → renderpage and calls usercanviewpage(request.user, page) (returning 404 when the user may not view the page), the structure endpoint performs no page-level authorization.
The rendered structure board includes each plugin's getshortdescription() (e.g. link names/URLs, text snippets), so the content of a restricted page is disclosed, not just its shape.
Impact A staff user (any account with isstaff=True) who lacks view permission on a view-restricted page can retrieve that page's plugin structure and short descriptions by requesting the structure endpoint with the page's content-type id and object id.
This only applies when CMSPERMISSION=True and the page has view restrictions (or CMSPUBLICFOR='staff'). Sites without per-page view restrictions are not affected.
Patches Fixed in 5.0.8: the structure endpoint now enforces usercanviewpage() for PageContent objects, matching edit/preview.
Workarounds None other than restricting staff access. Upgrade is recommended.
Credits Reported by the security team at the University of Sydney ([@reporter]).
Other sources
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, renderobjectstructure in cms/views.py renders cms/toolbar/structure.html for a PageContent object without calling usercanviewpage(). Any staff account can request a restricted page’s structure when CMSPERMISSION is enabled and the page has view restrictions or CMSPUBLICFOR is set to staff. The response exposes plugin getshortdescription() values, including link names, URLs, and text snippets, rather than only the page shape. This issue is fixed in versions 5.0.8.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/django-cmsto a version that resolves this vulnerability.Fixed in 5.0.8 - Upgrade
Upgrade
django CMSto a version that resolves this vulnerability.Fixed in 5.0.8 - Compensating control
If you cannot upgrade to django CMS 5.0.8 immediately, restrict access to the structure endpoint (`render_object_structure` in `cms/views.py`) so that only staff users who are authorized to view the specific view-restricted page can call it (problem affects staff accounts when `CMS_PERMISSION=True` and the page has view restrictions or `CMS_PUBLIC_FOR='staff'`).
Event History
Frequently Asked Questions
Who can exploit this issue?
Any staff account can exploit it when CMS_PERMISSION is enabled and the target page has view restrictions or CMS_PUBLIC_FOR is set to staff. The attacker does not need permission to view the restricted page.
What information can be exposed?
The structure response can expose plugin get_short_description() values. Depending on the plugins used, this may include link names, URLs, and text snippets.
Which versions are fixed?
django CMS 5.0.8 includes the fix. Versions prior to 5.0.8 are affected under the described permission configuration.
What can be done if upgrading is not immediately possible?
The provided information identifies exposure only when CMS_PERMISSION is enabled and pages use view restrictions or CMS_PUBLIC_FOR is set to staff. Review those settings and restrict staff access where possible until the fix can be applied.