CyberRota Analysis
AI-GeneratedThe vulnerability in django CMS affects the authorization of non-PageContent objects using PlaceholderRelationField, allowing unauthorized staff users to access sensitive information through a specific admin endpoint. This exposure can lead to the disclosure of placeholder slot names, plugin identifiers, and other critical data, potentially compromising the integrity of frontend-editable content. Organizations using versions prior to 5.0.9 should prioritize patching this vulnerability to safeguard their content management systems.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, render_object_structure fails to authorize non-PageContent objects that use PlaceholderRelationField. An active staff user without cms.use_structure or model-level view or change permission can request the //admin/cms/placeholder/object/<content_type_id>/structure/<object_id>/ endpoint with guessed content_type_id and object_id values. The response discloses placeholder slot names, plugin trees, plugin identifiers, labels, and object existence for frontend-editable objects. The fix applies user_can_view_placeholder_source to the non-PageContent branch while keeping the structure board read-only for view-only users. This issue is fixed in versions 5.0.9.