CVE-2026-63003: 
Python vulnerability analysis and mitigation

CVE-2026-63003 is a broken access control vulnerability in django CMS's page duplication feature that allows authenticated low-privileged staff users to copy the content of any page — including restricted or cross-site pages — without authorization. It affects django-cms versions up to and including 5.0.8, and was fixed in version 5.0.9. The vulnerability was published on July 10, 2026 by researcher fsbraun and added to the GitHub Advisory Database on August 20, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) (Github Advisory).

The root cause is a missing object-level authorization check (CWE-862) combined with an authorization bypass through a user-controlled key (CWE-639) in the page duplication flow. Specifically, DuplicatePageForm.source is a ModelChoiceField with a queryset spanning every page in the database across all sites, and AddPageForm.__init__ returns early when the source widget is hidden — meaning the queryset is never narrowed to the user's permitted scope. The AddPageForm.clean() method only validates URL uniqueness and never checks the user's relationship to the source page, while duplicate() in pageadmin.py seeds the source from the URL on GET but accepts it entirely from the POST body. When AddPageForm.save() calls from_source(), it invokes source.copy(..., permissions=False), which copies all placeholders and plugins from the target page and strips its view restrictions, making the resulting copy publicly readable (Github Advisory, Fix PR).

A staff user restricted via CMS_PERMISSION to their own site or subtree can exfiltrate the full plugin content of any page in the database — including pages on other tenants' sites or pages with explicit view restrictions. Because copy(..., permissions=False) strips the source page's view restrictions, the duplicated page becomes publicly accessible, meaning even anonymous visitors can read the exfiltrated content from the front end without any further permissions. There is no integrity or availability impact; the vulnerability is purely a confidentiality breach affecting potentially all content managed by the CMS instance (Github Advisory).

A proof-of-concept is included in the official security advisory, demonstrating that exploitation requires only a valid staff session with cms.add_page permission and knowledge of a target page's ID (SECRET_ID). No exploit kits or in-the-wild exploitation have been reported. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. No threat actor attribution is available (Github Advisory).

1. Obtain staff access: Log in as a staff user (attacker) who holds the cms.add_page permission but has no view or change permission on the target restricted page (SECRET_ID).
2. Identify the target page ID: Enumerate page IDs through the CMS admin interface or by observing URLs of accessible pages. The target page ID can be any page in the database, including those on other sites or with view restrictions.
3. Craft a malicious POST request: Send a POST request to the duplicate endpoint, placing the attacker's own accessible page content ID in the URL path but substituting the victim page's ID in the POST body source parameter:

POST /admin/cms/pagecontent/<attacker_page_content_id>/duplicate/ HTTP/1.1
Cookie: sessionid=<attacker_session>
Content-Type: application/x-www-form-urlencoded

csrfmiddlewaretoken=<token>&title=x&slug=x&language=en&source=<SECRET_ID>

4. Retrieve the duplicated content: The server creates a new, unrestricted page on the attacker's site containing a verbatim copy of all plugins from the secret page. Because copy(..., permissions=False) strips view restrictions, user_can_view_page() returns True for the copy, and the attacker (or any anonymous visitor) can read the content directly from the front end (Github Advisory).

• Network: Unexpected POST requests to /admin/cms/pagecontent/<id>/duplicate/ where the source parameter in the POST body does not match the page ID in the URL path; requests originating from staff accounts with limited permissions targeting page IDs outside their assigned site or subtree.
• Logs: Django admin access logs showing POST to duplicate endpoints by users who do not have view/change permissions on the referenced source page; creation of new pages with content identical to restricted or cross-site pages.
• Application: Newly created pages appearing on a site whose content mirrors restricted pages from another site or subtree; pages that should be restricted becoming publicly accessible without an explicit permission change.

Upgrade django-cms to version 5.0.9 or later, which adds a clean_source() method to DuplicatePageForm that calls user_can_view_page(self._user, source) and raises a ValidationError if the user lacks view permission on the source page (Release 5.0.9, Fix Commit). As a temporary workaround prior to patching, restrict the cms.add_page permission exclusively to fully-trusted staff users, or disable the page duplicate action for delegated or limited editors (Github Advisory).