PyPI/django-cms CVE-2026-61663: medium 4.3, EPSS 0.34%
django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff
Action: Upgrade django-cms to 5.0.9 or later.
pip install django-cms==5.0.9Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 5.0.9 | - |
Fixed versions
| 5.0.9 |
Sources
- osv: GHSA-8qj2-c6q4-f399
- https://github.com/django-cms/django-cms/security/advisories/GHSA-8qj2-c6q4-f399
- https://github.com/django-cms/django-cms/pull/8703
- https://github.com/django-cms/django-cms/commit/9c82abfeb25471583e23906ea1ebef9202527b04
- https://github.com/django-cms/django-cms
- https://github.com/django-cms/django-cms/releases/tag/5.0.9
CVE-2026-61663 · published · modified · JSON