CVE-2026-54624: django CMS Structure Endpoint Vulnerability Disclosed

A vulnerability identified as CVE-2026-54624 affects django CMS versions prior to 5.0.8. The flaw allows any staff account to bypass page-view permissions, exposing restricted page structures. This occurs when the 'render_object_structure' function does not enforce user permissions, leading to potential data leakage of sensitive information such as link names and URLs. The vulnerability is rated with a CVSS score of 6.5, indicating a medium severity. It has been confirmed that the issue is fixed in version 5.0.8, released shortly after the vulnerability was disclosed. The flaw primarily impacts organizations using django CMS with specific permission settings enabled. Security updates are recommended for affected users to mitigate risks.

Key Points: • CVE-2026-54624 allows unauthorized access to restricted page structures in django CMS. • The vulnerability affects versions prior to 5.0.8 and has a CVSS score of 6.5. • Users are urged to upgrade to version 5.0.8 to mitigate the risk of exploitation.