CVE-2026-61663

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, render_object_structure fails to authorize non-PageContent objects that use PlaceholderRelationField. An active staff user without cms.use_structure or model-level view or change permission can request the //admin/cms/placeholder/object/<content_type_id>/structure/<object_id>/ endpoint with guessed content_type_id and object_id values. The response discloses placeholder slot names, plugin trees, plugin identifiers, labels, and object existence for frontend-editable objects. The fix applies user_can_view_placeholder_source to the non-PageContent branch while keeping the structure board read-only for view-only users. This issue is fixed in versions 5.0.9.

• CWE-639
• CWE-862

• https://github.com/django-cms/django-cms/commit/9c82abfeb25471583e23906ea1ebef9202527b04
• https://github.com/django-cms/django-cms/pull/8703
• https://github.com/django-cms/django-cms/releases/tag/5.0.9
• https://github.com/django-cms/django-cms/security/advisories/GHSA-8qj2-c6q4-f399
• https://github.com/django-cms/django-cms/security/advisories/GHSA-8qj2-c6q4-f399

Published

Aug 20, 2026

Last Modified

Sep 9, 2026

Status

Awaiting Analysis

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-61641Wallos is an open-source, self-hostable personal subscriptio…8.1
• CVE-2026-61643FastGPT is a knowledge-based AI application platform. From 4…5.9
• CVE-2026-61644FastGPT is a knowledge-based AI application platform. From 4…7.7
• CVE-2026-61646FastGPT is a knowledge-based AI application platform. Prior …6.3
• CVE-2026-6165A weakness has been identified in code-projects Vehicle Show…7.3
• CVE-2026-6166A security vulnerability has been detected in code-projects …7.3
• CVE-2026-61666websocket-driver is a WebSocket protocol handler with plugga…8.9
• CVE-2026-61667DIRAC is an interware, meaning a software framework for dist…9.9
• CVE-2026-61668DIRAC is an interware, meaning a software framework for dist…8.1
• CVE-2026-6167A vulnerability was detected in code-projects Faculty Manage…7.3
• CVE-2026-6168A flaw has been found in TOTOLINK A7000R up to 9.1.0u.6115. …8.8
• CVE-2026-61684FastGPT is a knowledge-based AI application platform. In 4.1…8.8