CVE-2026-63003

django CMS: Broken access control in page Duplicate allows reading the content of any page (cross-site / restriction bypass)

The only authorization gate on the duplicate flow is PageAdmin.has_add_permission,
which checks user_can_add_page(user, site) / user_can_add_subpage(...), i.e. “may
this user create a page at all”. Nothing checks the user’s relationship to the page being
copied:

• cms/admin/forms.py, DuplicatePageForm.source = ModelChoiceField(queryset=Page.objects.all(), widget=HiddenInput())
  spans every page in the database, on every site.
• cms/admin/forms.py, AddPageForm.__init__ returns early when the source widget is
  hidden, so the queryset is never narrowed to the user’s site/subtree.
• cms/admin/forms.py, AddPageForm.clean() validates only URL uniqueness; source is
  never validated against the user.
• cms/admin/pageadmin.py, duplicate() seeds source from the URL only on GET; on
  POST the value comes entirely from the request body.
• cms/admin/forms.py, AddPageForm.save() → from_source() performs
  source.copy(..., permissions=False) and copies every placeholder and all plugins of
  source into a new page on the attacker’s site. Because permissions=False drops the
  source’s view restrictions, the resulting copy is fully readable by the attacker.

This crosses a real privilege boundary: a staff user restricted (via CMS_PERMISSION) to
their own site or subtree can exfiltrate the content of restricted pages and of pages
belonging to other tenants.

Read-back is trivial (verified): the copy is created on the attacker’s site and, because
copy(..., permissions=False) strips the source’s view restrictions, the new page is
unrestricted. user_can_view_page() then returns True for it (unrestricted +
PUBLIC_FOR), so the attacker, or even an anonymous visitor, can read the duplicated
content directly from the front end. No further permission on the new page is required.

The application does not perform an authorization check before performing a sensitive operation. Typical impact: unauthorized access to restricted functionality or data.

CVE-2026-63003 has a CVSS score of 6.5 (Medium). The vector is network-reachable, low privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (5.0.9); upgrading removes the vulnerable code path.

Kodem intelligence

Already deployed Kodem?

Enforce an object-level permission check on source:

class DuplicatePageForm(AddPageForm):
    source = forms.ModelChoiceField(
        queryset=Page.objects.all(),
        required=True,
        widget=forms.HiddenInput(),
    )

    def clean_source(self):
        source = self.cleaned_data.get("source")
        if source and not user_can_view_page(self._user, source):
            raise ValidationError(_("You do not have permission to copy this page."))
        return source

(user_can_view_page is imported from cms.utils.page_permissions.)

1. What is CVE-2026-63003? CVE-2026-63003 is a medium-severity missing authorization vulnerability in django-cms (pip), affecting versions <= 5.0.8. It is fixed in 5.0.9. The application does not perform an authorization check before performing a sensitive operation.
2. How severe is CVE-2026-63003? CVE-2026-63003 has a CVSS score of 6.5 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of django-cms are affected by CVE-2026-63003? django-cms (pip) versions <= 5.0.8 is affected.
4. Is there a fix for CVE-2026-63003? Yes. CVE-2026-63003 is fixed in 5.0.9. Upgrade to this version or later.
5. Is CVE-2026-63003 exploitable, and should I be worried? Whether CVE-2026-63003 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-63003 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-63003? Upgrade django-cms to 5.0.9 or later.

Other vulnerabilities in django-cms