https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T09:30:27.654112+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-54622 CVE-2026-54622 — django CMS: Clipboard copy IDOR discloses unauthorized plugin content 2026-10-07T09:30:27.672318+00:00

Affected: django-cms

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the copy_plugins endpoint in cms/admin/placeholderadmin.py authorizes only the destination clipboard. The _copy_plugin_to_clipboard and _copy_placeholder_to_clipboard paths accept source_placeholder_id and source_plugin_id values but use has_copy_plugins_permission and check_source only for the requesting user’s clipboard, without validating the source placeholder. Under CMS_PERMISSION, a staff user with the global add permission for a plugin type can copy plugins from an unauthorized page or placeholder into the user’s clipboard and read secret text, link names, and URLs. This issue is fixed in versions 5.0.8.