CVE-2026-61663: 
Python vulnerability analysis and mitigation

CVE-2026-61663 is a missing authorization vulnerability in django CMS's render_object_structure view that discloses CMS placeholder and plugin structure metadata to low-privileged staff users. It affects django-cms versions >= 4.0.0 through <= 5.0.x and 5.1.0a1, introduced when frontend-editing endpoints were added in version 4.0. The vulnerability was reported by doanmanhducz, published to the GitHub Advisory Database on August 20, 2026, and fixed in version 5.0.9. It carries a CVSS v3.1 base score of 4.3 (Medium) (Github Advisory, Feedly).

The root cause is a missing object-level authorization check (CWE-862) in the render_object_structure view for non-PageContent objects, compounded by an authorization bypass through user-controlled key values (CWE-639). The vulnerable endpoint GET /admin/cms/placeholder/object/<content_type_id>/structure/<object_id>/ accepted attacker-supplied content_type_id and object_id parameters without verifying whether the requesting user had view or change permission on the target object. PageContent objects had already been protected by a prior fix (GHSA/PR #8644), but the non-PageContent branch — covering models using PlaceholderRelationField — remained unguarded. The fix introduces a user_can_view_placeholder_source helper in cms/utils/permissions.py that checks for a custom has_placeholder_view_permission hook or falls back to model/object-level view or change permissions, returning HTTP 404 when authorization fails (Github Advisory, Fix PR).

Exploitation allows a low-privileged staff user (is_staff=True) to read CMS structure metadata — including placeholder slot names, plugin trees, plugin identifiers and labels, and object existence — for non-PageContent frontend-editable objects they are not authorized to access. There is no integrity or availability impact; the vulnerability is strictly a confidentiality issue limited to CMS structural metadata rather than arbitrary field data or user content. The risk is most significant for deployments using third-party or custom django-cms apps that expose frontend-editable objects outside the standard page tree, where the disclosed structure could reveal editorial workflows, content organization, or the existence of objects owned by other staff teams (Github Advisory).

No public exploit code or in-the-wild exploitation has been reported. The vulnerability requires an authenticated, active staff account (is_staff=True), making it staff-gated and limiting the attacker pool. The attacker must also be able to guess or enumerate valid content_type_id and object_id values, and the target deployment must expose at least one non-PageContent model with PlaceholderRelationField. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Github Advisory, Feedly).

1. Obtain staff access: Acquire or compromise an active Django staff account (is_staff=True) on the target django-cms deployment — no special CMS permissions are required.
2. Identify target deployment: Confirm the deployment uses non-PageContent models with PlaceholderRelationField (e.g., custom apps or third-party django-cms extensions with frontend-editable objects).
3. Enumerate content type IDs: Query the Django admin interface or use authenticated API calls to enumerate valid content_type_id values corresponding to non-PageContent models registered with django-cms frontend editing.
4. Enumerate object IDs: Guess or iterate sequential integer object_id values for the target content type.
5. Request the structure endpoint: Send an authenticated GET request to //admin/cms/placeholder/object/<content_type_id>/structure/<object_id>/ for each candidate ID pair.
6. Extract structure metadata: Parse the HTTP 200 response body to extract placeholder slot names, plugin tree layout, plugin identifiers, labels, and confirm object existence — all without requiring change permission or cms.use_structure permission (Github Advisory, Fix PR).

• Network: Repeated authenticated GET requests to /admin/cms/placeholder/object/<id>/structure/<id>/ from a staff user account that does not normally access those objects; sequential or enumerated content_type_id and object_id values in request URLs suggesting automated scanning.
• Logs: Django access logs showing HTTP 200 responses to the cms_placeholder_render_object_structure endpoint for a staff user lacking view or change permissions on the accessed content type; high volume of requests to this endpoint from a single user in a short time window.
• Logs: After patching, HTTP 404 responses to the same endpoint from accounts that previously received 200 responses may indicate prior unauthorized access attempts that are now blocked (Github Advisory).

Upgrade django-cms to version 5.0.9 or later, which applies the user_can_view_placeholder_source authorization check to the non-PageContent branch of render_object_structure and returns HTTP 404 for unauthorized requests. There is no configuration-based workaround available. Deployments that do not register any non-PageContent frontend-editable model (i.e., no models using PlaceholderRelationField) are not affected and do not require immediate action, though upgrading is still recommended (Github Advisory, Release 5.0.9).