CVE-2026-63003

django CMS versions before 5.0.9 contain an authorization bypass where users with only add_page permission can copy content from any page, including restricted pages they should not be able to read. The vulnerability lives in the AddPageForm: a hidden source_page field lets users specify which page to copy content from, but the server never validates that the requesting user has any permission to access that source page. The pageadmin checks add_page permission, which passes, and treats copy-source access as implied by the ability to create new pages — a dangerous assumption that treats two fundamentally different operations as one. The practical impact is severe. A staff user with the lowest privilege tier — someone who can only add new pages — can silently mirror every placeholder, plugin, and piece of content from restricted subtrees, cross-site editorial structures, and pages they cannot otherwise view. This is exfiltration through a permission tier routinely granted to content editors and contractors, not a privileged administrator attack. To determine if you're exposed: confirm your django CMS version (anything below 5.0.9 is vulnerable), then audit user roles. Any role with add_page permission on any site is exploitable, regardless of whether permissions=True is enforced elsewhere. The attack requires no special knowledge — the attacker manipulates the hidden source_page field in the add page form. The fix in 5.0.9 adds object-level validation on the source page, checking that the requesting user has actual access to the source before allowing the copy operation. Beyond applying the patch, treat this as a signal to audit other copy-like operations in your django CMS instance — page cloning across sites, template inheritance with content mirroring, revision branching — as these often inherit the same implicit trust model where copy is treated as a subset of create rather than a distinct operation requiring independent authorization.

Reviewed through automated stages and approved by a human before publication.