CVE-2026-54625: django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)
django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request headers declared by plugins through getvarycacheon(). The pagecachekey function includes the cache prefix, site, language, path, and timezone but not the declared header values. Although setpagecache adds those names to the response Vary header, getpagecache retrieves the first stored variant under the same header-agnostic key. When CMSPAGECACHE is enabled and a plugin varies content on a header such as Country-Code, one visitor can receive another visitor’s request-specific content, and an unauthenticated attacker can prime the cache with attacker-chosen content. This issue is fixed in versions 5.0.8 and 5.1.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
django CMSto a version that resolves this vulnerability.Fixed in 5.0.8 - Upgrade
Upgrade
django CMSto a version that resolves this vulnerability.Fixed in 5.1.0
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments with CMS_PAGE_CACHE enabled are affected if a plugin uses get_vary_cache_on() to vary content based on request headers, such as Country-Code. The issue affects versions before 5.0.8 and version 5.1.0a1.
What does an attacker need to exploit this issue?
An attacker does not need authentication or user interaction. They need to make requests that cause request-specific plugin content to be cached; because the cache key omits plugin-declared header values, the cached response can be served to visitors with different header values.
What can be done if an upgrade is not immediately possible?
Disable CMS_PAGE_CACHE where plugins vary content based on request headers. This prevents the affected page-cache lookup behavior from serving a single cached variant across differing header values.
How can I determine whether my site is exposed?
Check whether CMS_PAGE_CACHE is enabled and review plugins for get_vary_cache_on() implementations. Test requests to the same page using different values for headers declared by those plugins; receiving the first cached variant despite different header values indicates exposure.