CVE-2026-54624 National Vulnerability Database / 1d django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, render_object_structure in cms/views.py renders cms/toolbar/structure.html for a PageContent object without calling user_can_view_page(). Any staff account can request a restricted page’s structure when CMS_PERMISSION is enabled and the page has view restrictions or CMS_PUBLIC_FOR is set to staff. The response exposes plug

nvd.nist.gov • August 22, 2026

This CVE record has recently been published to the CVE List and has been included within the NVD dataset.

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, render_object_structure in cms/views.py renders cms/toolbar/structure.html for a PageContent object without calling user_can_view_page(). Any staff account can request a restricted page’s structure when CMS_PERMISSION is enabled and the page has view restrictions or CMS_PUBLIC_FOR is set to staff. The response exposes plugin get_short_description() values, including link names, URLs, and text snippets, rather than only the page shape. This issue is fixed in versions 5.0.8.

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address this page to [email protected] .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CVE-2026-54624: django CMS Structure Endpoint Vulnerability Disclosed A vulnerability identified as CVE-2026-54624 affects django CMS versions prior to 5.0.8. The flaw allows any staff account to bypass page-view permissions, exposing restricted page structures. This occurs when the 'render_object_structure' function does not enforce user permissions, leading to potential data leakage of sensitive information such as link names and URLs. The vulnerability is rated with a CVSS score of 6.5, indicating a medium severity. It has been confirmed that the issue is fixed in version 5.0.8, released shortly after the vulnerability was disclosed. The flaw primarily impacts organizations using django CMS with specific permission settings enabled. Security updates are recommended for affected users to mitigate risks. 1 sources 58

Extracted Entities

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (2)