CyberRota Analysis
AI-GeneratedDjango CMS versions prior to 5.0.8 are vulnerable due to a flaw in the render_object_structure function, which allows staff accounts to access restricted page structures without proper permission checks. This exposure can reveal sensitive information such as link names, URLs, and text snippets, potentially compromising the confidentiality of restricted content. Organizations using affected versions should prioritize upgrading to 5.0.8 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, render_object_structure in cms/views.py renders cms/toolbar/structure.html for a PageContent object without calling user_can_view_page(). Any staff account can request a restricted page’s structure when CMS_PERMISSION is enabled and the page has view restrictions or CMS_PUBLIC_FOR is set to staff. The response exposes plugin get_short_description() values, including link names, URLs, and text snippets, rather than only the page shape. This issue is fixed in versions 5.0.8.