CVE-2026-93455: django-page-cms through 2.0.13 Unauthorized Content Access via Staff Account
django-page-cms through 2.0.13 fails to properly validate page permissions in admin helper views, allowing any staff account to read arbitrary page content and stored media paths. Attackers with low-privilege staff credentials can enumerate content identifiers and access unpublished drafts, page listings, and file paths without proper authorization checks.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs credentials for any staff account. The issue allows low-privilege staff users to access content beyond the page permissions assigned to them.
What information can an unauthorized staff user obtain?
They can read arbitrary page content, including unpublished drafts and page listings, and retrieve stored media paths. They can also enumerate content identifiers through the affected admin helper views.
Are non-staff or unauthenticated users affected?
The available information identifies staff-account access as the required privilege level. It does not state that unauthenticated or non-staff users can exploit the issue.
Which versions are affected?
django-page-cms through version 2.0.13 is affected. No fixed version is provided in the available information.