django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

6.5 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

• CVE-2026-63003: 0.41% estimated exploitation activity in the next 30 days; percentile 35.86 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Impact The only authorization gate on the duplicate flow is PageAdmin.hasaddpermission, which checks usercanaddpage(user, site) / usercanaddsubpage(...) — i.e. “may this user create a page at all”. Nothing checks the user’s relationship to the page being copied: - cms/admin/forms.py — DuplicatePageForm.source = ModelChoiceField(queryset=Page.objects.all(), widget=HiddenInput()) spans every page in the database, on every site. - cms/admin/forms.py — AddPageForm.init returns early when the source widget is hidden, so the queryset is never narrowed to the user’s site/subtree. - cms/admin/forms.py — AddPageForm.clean() validates only URL uniqueness; source is never validated against the user. - cms/admin/pageadmin.py — duplicate() seeds source from the URL only on GET; on POST the value comes entirely from the request body. - cms/admin/forms.py — AddPageForm.save() → fromsource() performs source.copy(..., permissions=False) and copies every placeholder and all plugins of source into a…

Published by the source

20 Aug 2026, 18:42 UTC

Last modified by the source

20 Aug 2026, 18:42 UTC

Source last checked

26 Oct 2026, 13:50 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-6x92-6vx4-5fwr

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2026-63003

Advisory: django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)
IDs: CVE-2026-63003, GHSA-6x92-6vx4-5fwr
Record: https://patchnext.com/advisories/cve-2026-63003 (revision 1, source checked 26 Oct 2026, 13:50 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Medium (CVSS 6.5)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: django-cms 5.0.9. A vendor fix does not mean a deployment is fixed.

## Affected components
- PyPI django-cms: affected <= 5.0.8; fixed in 5.0.9

## Suggested inspection (read-only)
- `python -m pip show django-cms`: prints the installed version. Run with the environment that serves production active.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on django-cms.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-6x92-6vx4-5fwr (GitHub-reviewed advisory GHSA-6x92-6vx4-5fwr lists affected ranges: PyPI django-cms >=0 <=5.0.8)

Commands are suggestions: review each one before running it.