CVE-2026-61663 django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff
Low-privileged staff users can access placeholder structure data for non-PageContent objects without proper authorization, leading to information disclosure.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-61663?
CVE-2026-61663 is a medium-severity missing authorization vulnerability in django-cms, published on 20 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, render_object_structure fails to authorize non-PageContent objects that use PlaceholderRelationField. An active staff user without cms.use_structure or model-level view or change permission can request the //admin/cms/placeholder/object/<content_type_id>/structure/<object_id>/ endpoint with guessed content_type_id and object_id values. The response discloses placeholder slot names, plugin trees, plugin identifiers, labels, and object existence for frontend-editable objects. The fix applies user_can_view_placeholder_source to the non-PageContent branch while keeping the structure board read-only for view-only users. This issue is fixed in versions 5.0.9.
Which versions are affected by CVE-2026-61663?
3 open source packages ship an affected version, including django-cms.
| Package | Affected | Fixed in |
|---|---|---|
django-cms PyPI | All versions | 5.0.9 |
django-cms PyPI | All versions | 5.0.9 |
django-cms PyPI | All versions | 5.0.9 |
How do I fix CVE-2026-61663?
Upgrade django-cms to 5.0.9 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-61663 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-61663 exists.
Sources
Also known as GHSA-8qj2-c6q4-f399, PYSEC-2026-3823.