CVE-2026-54622: 
Python vulnerability analysis and mitigation

CVE-2026-54622 is an Insecure Direct Object Reference (IDOR) vulnerability in django CMS that allows an authenticated staff user to copy plugins from unauthorized placeholders into their own clipboard, disclosing restricted content. It affects all versions of django-cms prior to 5.0.8. The vulnerability was reported by the security team at the University of Sydney, disclosed via GitHub Security Advisory on June 12, 2026, and published to NVD on August 20, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory).

The root cause is an authorization bypass through user-controlled key (CWE-639) in cms/admin/placeholderadmin.py. The _copy_plugin_to_clipboard and _copy_placeholder_to_clipboard methods within the copy_plugins admin endpoint call has_copy_plugins_permission and check_source, but these checks are applied only to the destination clipboard (which belongs to the requesting user) — not to the attacker-supplied source_placeholder_id or source_plugin_id. By contrast, the placeholder-to-placeholder copy path (has_copy_from_placeholder_permission) correctly validates both sides. An attacker must be an authenticated staff user with the global add permission for a plugin type, and the site must have CMS_PERMISSION=True with per-placeholder or per-page restrictions configured (GitHub Advisory, Fix PR).

A staff user with no access to a given page or placeholder can exfiltrate its plugin content — including secret text, link names, and URLs — by copying those plugins into their own clipboard via the vulnerable endpoint. The impact is limited to confidentiality (no integrity or availability impact), but the exposed data may include sensitive internal content such as unpublished page content, internal link targets, or restricted editorial material. Exploitation is constrained to sites running with CMS_PERMISSION=True and per-placeholder/page access controls (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires an authenticated staff account with at least the global add permission for a plugin type, limiting the attack surface to insider threats or compromised staff credentials (GitHub Advisory, Feedly).

1. Reconnaissance: Identify a django CMS instance running with CMS_PERMISSION=True and per-page/placeholder restrictions. Obtain or compromise a staff account that has the global add permission for at least one plugin type (e.g., add_link) but lacks access to a restricted page or placeholder.
2. Identify target placeholder: Enumerate placeholder IDs for restricted pages (e.g., by inspecting CMS admin responses, page source, or API endpoints accessible to staff users) to find a source_placeholder_id or source_plugin_id belonging to a page the attacker cannot normally access.
3. Craft malicious copy request: Send a POST request to the copy_plugins admin endpoint (e.g., /en/admin/cms/page/copy-plugins/) with the attacker's own clipboard as target_placeholder_id and the victim's restricted placeholder/plugin IDs as source_placeholder_id/source_plugin_id.
4. Read exfiltrated content: After the server processes the request (returning HTTP 200 on vulnerable versions), inspect the attacker's clipboard via the CMS admin interface or API to read the copied plugin content, including link names, URLs, and text from the restricted placeholder (GitHub Advisory, Fix PR).

• Logs: Django/CMS access logs showing POST requests to the copy_plugins admin endpoint (e.g., /en/admin/cms/page/copy-plugins/) from a staff user account, with source_placeholder_id or source_plugin_id values referencing placeholders not associated with pages the user has access to.
• Logs: Repeated or scripted POST requests to the clipboard copy endpoint from a single staff user in a short time window, potentially enumerating placeholder IDs.
• Application Behavior: Unexpected plugin content appearing in a staff user's clipboard that belongs to pages or placeholders outside their permission scope, observable via CMS admin clipboard inspection.

Upgrade django-cms to version 5.0.8 or later, which adds source-side permission checks (has_add_plugins_permission and check_source on the source placeholder) to both _copy_plugin_to_clipboard and _copy_placeholder_to_clipboard, matching the existing behavior of the placeholder-to-placeholder copy path. No workaround is available; the vendor explicitly recommends upgrading as the only remediation. Sites not using CMS_PERMISSION=True with per-placeholder/page restrictions are not affected by this specific issue (GitHub Advisory, Release 5.0.8).

The vulnerability was reported by the security team at the University of Sydney and credited to researchers Str1ckl4nd, 7thParkk, and mauriceng98. The fix was developed and merged by django-cms maintainer fsbraun, with the patch also addressing related security issues including cyclic plugin move prevention and structure endpoint access control. No significant broader media coverage or social media discussion has been identified beyond the GitHub advisory and associated pull request (GitHub Advisory, Fix PR).