EXECUTIVE SUMMARY:
Multiple vulnerabilities were identified in django CMS that could allow stored cross-site scripting (XSS), unauthorized content disclosure, and privilege boundary bypasses in CMS editing workflows. The first issue affects plugin rendering error handling, where unescaped stored content could be injected into exception messages and executed in staff users' browsers during edit mode. The second vulnerability impacts the page duplication feature, allowing low-privileged staff users with page creation permissions to copy restricted pages from other sites or subtrees without proper authorization checks, exposing protected content. The third flaw affects the frontend-editing structure endpoint, where insufficient object-level authorization allowed authenticated staff users to access placeholder and plugin structure information of non-PageContent objects without required permissions. All issues are resolved through improved HTML escaping and authorization validation controls.[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY:
Multiple vulnerabilities were identified in django CMS that could allow stored cross-site scripting (XSS), unauthorized content disclosure, and privilege boundary bypasses in CMS editing workflows. The first issue affects plugin rendering error handling, where unescaped stored content could be injected into exception messages and executed in staff users' browsers during edit mode. The second vulnerability impacts the page duplication feature, allowing low-privileged staff users with page creation permissions to copy restricted pages from other sites or subtrees without proper authorization checks, exposing protected content. The third flaw affects the frontend-editing structure endpoint, where insufficient object-level authorization allowed authenticated staff users to access placeholder and plugin structure information of non-PageContent objects without required permissions. All issues are resolved through improved HTML escaping and authorization validation controls.[emaillocker id="1283"]
CVE-2026-75526 (CVSS 4.4 — Medium): A stored cross-site scripting (XSS) vulnerability in django CMS allows attackers to inject malicious HTML through plugin-related content, which can execute in staff users' browsers during edit-mode rendering when plugin exceptions occur.
CVE-2026-63003 (CVSS 6.5 — Medium): A broken authorization vulnerability in django CMS page duplication functionality allows low-privileged staff users to copy restricted pages and expose protected content by bypassing source page permission checks.
CVE-2026-61663 (CVSS 4.3 — Medium): An authorization bypass vulnerability in django CMS allows authenticated low-privileged staff users to access frontend-editing structure information of unauthorized non-PageContent objects, exposing placeholder layouts, plugin details, and object metadata without proper permissions.
RECOMMENDATIONS:
REFERENCES:
The following reports contain further technical details:
https://github.com/advisories/GHSA-hvq6-2r72-p2x7
https://github.com/advisories/GHSA-6x92-6vx4-5fwr
https://github.com/advisories/GHSA-8qj2-c6q4-f399