01 Record

CVE-2026-61663

django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff

MediumPUBLISHEDCNA: GitHub_M

Base score4.3 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

02 Description

django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff

Published

2026-08-20 18:07Z1 DAY AGO

Last updated

2026-08-20 18:07Z1 DAY AGO

Reserved

2026-07-10

Assigning CNA

GitHub_M

Record state

PUBLISHED

Severity

Medium (CVSS 4.3)

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weaknesses

SSVC decision

No CISA-ADP assessment

Data version

5.2

Document digest

4989e47dfd9b7b8241182fb910bae11dcd9d1ead46070ba31939cb4d7a4003c4

VendorProductVersionsPlatforms

django-cmsdjango-cms< 5.0.9—