CVE-2026-54625 django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)
Attackers can read other users' data or poison the cache in django CMS when page caching is enabled and plugins use Vary headers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-54625?
CVE-2026-54625 is a medium-severity vulnerability in django-cms, published on 20 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request headers declared by plugins through get_vary_cache_on(). The _page_cache_key function includes the cache prefix, site, language, path, and timezone but not the declared header values. Although set_page_cache adds those names to the response Vary header, get_page_cache retrieves the first stored variant under the same header-agnostic key. When CMS_PAGE_CACHE is enabled and a plugin varies content on a header such as Country-Code, one visitor can receive another visitor’s request-specific content, and an unauthenticated attacker can prime the cache with attacker-chosen content. This issue is fixed in versions 5.0.8 and 5.1.0.
Which versions are affected by CVE-2026-54625?
3 open source packages ship an affected version, including django-cms.
| Package | Affected | Fixed in |
|---|---|---|
django-cms PyPI | All versions | 5.0.8 |
django-cms PyPI | All versions | 5.0.8 |
django-cms PyPI | All versions | 5.0.8 |
How do I fix CVE-2026-54625?
Upgrade django-cms to 5.0.8 or later.
Is CVE-2026-54625 being exploited?
There is no known exploitation of CVE-2026-54625 in the wild and no public exploit code.
Sources
Also known as GHSA-fwjf-m4qw-9f2x, PYSEC-2026-3824.