Vulnerability-Lookup

CVE-2026-54625 (GCVE-0-2026-54625)

Vulnerability from cvelistv5 – Published: 2026-08-20 17:58 – Updated: 2026-08-20 19:45

Title

django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)

Summary

django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request headers declared by plugins through get_vary_cache_on(). The _page_cache_key function includes the cache prefix, site, language, path, and timezone but not the declared header values. Although set_page_cache adds those names to the response Vary header, get_page_cache retrieves the first stored variant under the same header-agnostic key. When CMS_PAGE_CACHE is enabled and a plugin varies content on a header such as Country-Code, one visitor can receive another visitor’s request-specific content, and an unauthenticated attacker can prime the cache with attacker-chosen content. This issue is fixed in versions 5.0.8 and 5.1.0.

Severity

4.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-20 19:45 UTC

CWE

CWE-349 - Acceptance of Extraneous Untrusted Data With Trusted Data
CWE-524 - Use of Cache Containing Sensitive Information

Assigner

GitHub_M mitre root Scorecard

References

7 references

URL	Tags
https://github.com/django-cms/django-cms/security…	x_refsource_CONFIRM
https://github.com/django-cms/django-cms/pull/8646	x_refsource_MISC
https://github.com/django-cms/django-cms/pull/8647	x_refsource_MISC
https://github.com/django-cms/django-cms/commit/8…	x_refsource_MISC
https://github.com/django-cms/django-cms/commit/d…	x_refsource_MISC
https://github.com/django-cms/django-cms/releases…	x_refsource_MISC
https://github.com/django-cms/django-cms/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
django-cms	django-cms	Affected: < 5.0.8 Affected: >= 5.1.0a1, < 5.1.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54625",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-20T19:45:03.782972Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-20T19:45:17.403Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "django-cms",
          "vendor": "django-cms",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.0.8"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.1.0a1, \u003c 5.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request headers declared by plugins through get_vary_cache_on(). The _page_cache_key function includes the cache prefix, site, language, path, and timezone but not the declared header values. Although set_page_cache adds those names to the response Vary header, get_page_cache retrieves the first stored variant under the same header-agnostic key. When CMS_PAGE_CACHE is enabled and a plugin varies content on a header such as Country-Code, one visitor can receive another visitor\u2019s request-specific content, and an unauthenticated attacker can prime the cache with attacker-chosen content. This issue is fixed in versions 5.0.8 and 5.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-349",
              "description": "CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-524",
              "description": "CWE-524: Use of Cache Containing Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-20T17:58:45.182Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/django-cms/django-cms/security/advisories/GHSA-fwjf-m4qw-9f2x",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/django-cms/django-cms/security/advisories/GHSA-fwjf-m4qw-9f2x"
        },
        {
          "name": "https://github.com/django-cms/django-cms/pull/8646",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/django-cms/django-cms/pull/8646"
        },
        {
          "name": "https://github.com/django-cms/django-cms/pull/8647",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/django-cms/django-cms/pull/8647"
        },
        {
          "name": "https://github.com/django-cms/django-cms/commit/8758714b865ffa79c6bcd0e5c503958ea48885aa",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/django-cms/django-cms/commit/8758714b865ffa79c6bcd0e5c503958ea48885aa"
        },
        {
          "name": "https://github.com/django-cms/django-cms/commit/d5dc1efa18d157445491c4b12c2dd1efd56f439f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/django-cms/django-cms/commit/d5dc1efa18d157445491c4b12c2dd1efd56f439f"
        },
        {
          "name": "https://github.com/django-cms/django-cms/releases/tag/5.0.8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/django-cms/django-cms/releases/tag/5.0.8"
        },
        {
          "name": "https://github.com/django-cms/django-cms/releases/tag/5.1.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/django-cms/django-cms/releases/tag/5.1.0"
        }
      ],
      "source": {
        "advisory": "GHSA-fwjf-m4qw-9f2x",
        "discovery": "UNKNOWN"
      },
      "title": "django CMS: Page cache ignores plugin-declared Vary headers (disclosure \u0026 poisoning)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54625",
    "datePublished": "2026-08-20T17:58:03.255Z",
    "dateReserved": "2026-06-15T20:07:02.185Z",
    "dateUpdated": "2026-08-20T19:45:17.403Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-54625",
      "date": "2026-10-03",
      "epss": "0.0018",
      "percentile": "0.06875"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "django-cms",
                "vendor": "django-cms",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 5.0.8"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 5.1.0a1, \u003c 5.1.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request headers declared by plugins through get_vary_cache_on(). The _page_cache_key function includes the cache prefix, site, language, path, and timezone but not the declared header values. Although set_page_cache adds those names to the response Vary header, get_page_cache retrieves the first stored variant under the same header-agnostic key. When CMS_PAGE_CACHE is enabled and a plugin varies content on a header such as Country-Code, one visitor can receive another visitor\u2019s request-specific content, and an unauthenticated attacker can prime the cache with attacker-chosen content. This issue is fixed in versions 5.0.8 and 5.1.0."
          }
        ],
        "id": "CVE-2026-54625",
        "lastModified": "2026-09-18T20:09:01.757",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.8,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.2,
              "impactScore": 2.5,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-54625",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-20T19:45:03.782972Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-08-20T18:16:28.170",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/django-cms/django-cms/commit/8758714b865ffa79c6bcd0e5c503958ea48885aa"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/django-cms/django-cms/commit/d5dc1efa18d157445491c4b12c2dd1efd56f439f"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/django-cms/django-cms/pull/8646"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/django-cms/django-cms/pull/8647"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/django-cms/django-cms/releases/tag/5.0.8"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/django-cms/django-cms/releases/tag/5.1.0"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/django-cms/django-cms/security/advisories/GHSA-fwjf-m4qw-9f2x"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-349"
              },
              {
                "lang": "en",
                "value": "CWE-524"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-54625",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-20T19:45:03.782972Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-20T19:45:11.491Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "django-cms",
              "vendor": "django-cms",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 5.0.8"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 5.1.0a1, \u003c 5.1.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request headers declared by plugins through get_vary_cache_on(). The _page_cache_key function includes the cache prefix, site, language, path, and timezone but not the declared header values. Although set_page_cache adds those names to the response Vary header, get_page_cache retrieves the first stored variant under the same header-agnostic key. When CMS_PAGE_CACHE is enabled and a plugin varies content on a header such as Country-Code, one visitor can receive another visitor\u2019s request-specific content, and an unauthenticated attacker can prime the cache with attacker-chosen content. This issue is fixed in versions 5.0.8 and 5.1.0."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.8,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-349",
                  "description": "CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-524",
                  "description": "CWE-524: Use of Cache Containing Sensitive Information",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-20T17:58:45.182Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/django-cms/django-cms/security/advisories/GHSA-fwjf-m4qw-9f2x",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/django-cms/django-cms/security/advisories/GHSA-fwjf-m4qw-9f2x"
            },
            {
              "name": "https://github.com/django-cms/django-cms/pull/8646",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/django-cms/django-cms/pull/8646"
            },
            {
              "name": "https://github.com/django-cms/django-cms/pull/8647",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/django-cms/django-cms/pull/8647"
            },
            {
              "name": "https://github.com/django-cms/django-cms/commit/8758714b865ffa79c6bcd0e5c503958ea48885aa",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/django-cms/django-cms/commit/8758714b865ffa79c6bcd0e5c503958ea48885aa"
            },
            {
              "name": "https://github.com/django-cms/django-cms/commit/d5dc1efa18d157445491c4b12c2dd1efd56f439f",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/django-cms/django-cms/commit/d5dc1efa18d157445491c4b12c2dd1efd56f439f"
            },
            {
              "name": "https://github.com/django-cms/django-cms/releases/tag/5.0.8",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/django-cms/django-cms/releases/tag/5.0.8"
            },
            {
              "name": "https://github.com/django-cms/django-cms/releases/tag/5.1.0",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/django-cms/django-cms/releases/tag/5.1.0"
            }
          ],
          "source": {
            "advisory": "GHSA-fwjf-m4qw-9f2x",
            "discovery": "UNKNOWN"
          },
          "title": "django CMS: Page cache ignores plugin-declared Vary headers (disclosure \u0026 poisoning)"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-54625",
        "datePublished": "2026-08-20T17:58:03.255Z",
        "dateReserved": "2026-06-15T20:07:02.185Z",
        "dateUpdated": "2026-08-20T19:45:17.403Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

EUVD-2026-357053

European Vulnerability Database identifier assigned by ENISA

Reserved

2026-10-02 08:28

Assigner

ENISA

Alias of

a CVE record, shown under related vulnerabilities. This identifier carries no description, severity or references of its own: they belong to that CVE.

JSON

To clipboard

{
  "assigner": "ENISA",
  "date_reserved": "2026-10-02T08:28:51.645502+00:00",
  "id": "EUVD-2026-357053"
}

FKIE_CVE-2026-54625

Vulnerability from fkie_nvd - Published: 2026-08-20 18:16 - Updated: 2026-09-18 20:09

Severity

4.8 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/django-cms/django-cms/commit/8758714b865ffa79c6bcd0e5c503958ea48885aa
	security-advisories@github.com	https://github.com/django-cms/django-cms/commit/d5dc1efa18d157445491c4b12c2dd1efd56f439f
	security-advisories@github.com	https://github.com/django-cms/django-cms/pull/8646
	security-advisories@github.com	https://github.com/django-cms/django-cms/pull/8647
	security-advisories@github.com	https://github.com/django-cms/django-cms/releases/tag/5.0.8
	security-advisories@github.com	https://github.com/django-cms/django-cms/releases/tag/5.1.0
	security-advisories@github.com	https://github.com/django-cms/django-cms/security/advisories/GHSA-fwjf-m4qw-9f2x

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "django-cms",
          "vendor": "django-cms",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.0.8"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.1.0a1, \u003c 5.1.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request headers declared by plugins through get_vary_cache_on(). The _page_cache_key function includes the cache prefix, site, language, path, and timezone but not the declared header values. Although set_page_cache adds those names to the response Vary header, get_page_cache retrieves the first stored variant under the same header-agnostic key. When CMS_PAGE_CACHE is enabled and a plugin varies content on a header such as Country-Code, one visitor can receive another visitor\u2019s request-specific content, and an unauthenticated attacker can prime the cache with attacker-chosen content. This issue is fixed in versions 5.0.8 and 5.1.0."
    }
  ],
  "id": "CVE-2026-54625",
  "lastModified": "2026-09-18T20:09:01.757",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.8,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 2.5,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-54625",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-20T19:45:03.782972Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-20T18:16:28.170",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/django-cms/django-cms/commit/8758714b865ffa79c6bcd0e5c503958ea48885aa"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/django-cms/django-cms/commit/d5dc1efa18d157445491c4b12c2dd1efd56f439f"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/django-cms/django-cms/pull/8646"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/django-cms/django-cms/pull/8647"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/django-cms/django-cms/releases/tag/5.0.8"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/django-cms/django-cms/releases/tag/5.1.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/django-cms/django-cms/security/advisories/GHSA-fwjf-m4qw-9f2x"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-349"
        },
        {
          "lang": "en",
          "value": "CWE-524"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-FWJF-M4QW-9F2X

Vulnerability from github – Published: 2026-08-24 20:09 – Updated: 2026-08-24 20:09

Summary

django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)

Details

Summary

The CMS page cache key ignores the request headers that plugins declare via get_vary_cache_on(). The header is added to the response Vary header, but the CMS's own cache key does not incorporate the header values, so the first visitor's variant is served to all subsequent visitors regardless of their header values.

Details

_page_cache_key (in cms/cache/page.py) keys only on cache prefix, site, language, path and timezone. set_page_cache collects the plugin-declared vary headers and calls patch_vary_headers(response, ...) (affecting only the emitted Vary header), but stores and retrieves the cached page under the header-agnostic key. get_page_cache therefore returns whichever variant was cached first.

Impact

Information disclosure: when a plugin varies its output on a request header (e.g. Country-Code), the variant rendered for the first anonymous visitor is served to everyone until the entry expires, leaking request-specific content across users.
Cache poisoning: an unauthenticated attacker can prime the anonymous page cache with content rendered from attacker-chosen header values, which is then served to subsequent visitors.

Applies only when CMS_PAGE_CACHE is enabled and at least one plugin implements get_vary_cache_on().

Patches

Fixed in 5.0.8: the page cache now folds the request's values implements get_vary_cache_on().

Patches

Fixed in 5.0.8: the page cache now folds the request's values for plugin-declared vary headers into the content key. The set of vary headers is persisted on write and looked up first on read (mirroring Django's learn_cache_key/get_cache_key); a missing header-list entry degrades to a cache miss, never a wrong-variant hit.

Workarounds

Disable CMS_PAGE_CACHE, or avoid plugins that rely on get_vary_cache_on(), until upgraded.

Credits

Reported by the security team at the University of Sydney ([@reporter]).

Severity

4.8 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "django-cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.0.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54625"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-349",
      "CWE-524"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-24T20:09:51Z",
    "nvd_published_at": "2026-08-20T18:16:28Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nThe CMS page cache key ignores the request headers that plugins declare via `get_vary_cache_on()`. The header is added to the response `Vary` header, but the CMS\u0027s own cache key does not incorporate the header values, so the first visitor\u0027s variant is served to all subsequent visitors regardless of their header values.\n\n### Details\n`_page_cache_key` (in `cms/cache/page.py`) keys only on cache prefix, site, language, path and timezone. `set_page_cache` collects the plugin-declared vary headers and calls `patch_vary_headers(response, ...)` (affecting only the emitted `Vary` header), but stores and retrieves the cached page under the header-agnostic key. `get_page_cache` therefore returns whichever variant was cached first.\n\n### Impact\n- **Information disclosure:** when a plugin varies its output on a request  header (e.g. `Country-Code`), the variant rendered for the first anonymous visitor is served to everyone until the entry expires, leaking request-specific content across users.\n- **Cache poisoning:** an unauthenticated attacker can prime the anonymous page cache with content rendered from attacker-chosen header values, which is then served to subsequent visitors.\n\nApplies only when `CMS_PAGE_CACHE` is enabled and at least one plugin implements `get_vary_cache_on()`.\n\n### Patches\nFixed in 5.0.8: the page cache now folds the request\u0027s values implements `get_vary_cache_on()`.\n\n### Patches\nFixed in 5.0.8: the page cache now folds the request\u0027s values for plugin-declared vary headers into the content key. The set of vary headers is persisted on write and looked up first on read (mirroring Django\u0027s  `learn_cache_key`/`get_cache_key`); a missing header-list entry degrades to a cache miss, never a wrong-variant hit.\n\n### Workarounds\nDisable `CMS_PAGE_CACHE`, or avoid plugins that rely on `get_vary_cache_on()`, until upgraded.\n\n### Credits\nReported by the security team at the University of Sydney ([@reporter]).",
  "id": "GHSA-fwjf-m4qw-9f2x",
  "modified": "2026-08-24T20:09:52Z",
  "published": "2026-08-24T20:09:51Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/django-cms/django-cms/security/advisories/GHSA-fwjf-m4qw-9f2x"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54625"
    },
    {
      "type": "WEB",
      "url": "https://github.com/django-cms/django-cms/pull/8646"
    },
    {
      "type": "WEB",
      "url": "https://github.com/django-cms/django-cms/pull/8647"
    },
    {
      "type": "WEB",
      "url": "https://github.com/django-cms/django-cms/commit/8758714b865ffa79c6bcd0e5c503958ea48885aa"
    },
    {
      "type": "WEB",
      "url": "https://github.com/django-cms/django-cms/commit/d5dc1efa18d157445491c4b12c2dd1efd56f439f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/django-cms/django-cms"
    },
    {
      "type": "WEB",
      "url": "https://github.com/django-cms/django-cms/releases/tag/5.0.8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/django-cms/django-cms/releases/tag/5.1.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "django CMS: Page cache ignores plugin-declared Vary headers (disclosure \u0026 poisoning)"
}

PYSEC-2026-3824

Vulnerability from pysec - Published: 2026-09-10 09:44 - Updated: 2026-09-10 11:02

Details

Summary

Details

Impact

Information disclosure: when a plugin varies its output on a request header (e.g. Country-Code), the variant rendered for the first anonymous visitor is served to everyone until the entry expires, leaking request-specific content across users.
Cache poisoning: an unauthenticated attacker can prime the anonymous page cache with content rendered from attacker-chosen header values, which is then served to subsequent visitors.

Applies only when CMS_PAGE_CACHE is enabled and at least one plugin implements get_vary_cache_on().

Patches

Fixed in 5.0.8: the page cache now folds the request's values implements get_vary_cache_on().

Patches

Workarounds

Disable CMS_PAGE_CACHE, or avoid plugins that rely on get_vary_cache_on(), until upgraded.

Credits

Reported by the security team at the University of Sydney ([@reporter]).

Severity

4.8 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Impacted products

Name	purl
django-cms	pkg:pypi/django-cms

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "django-cms",
        "purl": "pkg:pypi/django-cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.0.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.0.1",
        "2.0.2",
        "2.1.1",
        "2.1.2",
        "2.1.3",
        "2.1.4",
        "2.1.5",
        "2.2",
        "2.2.1",
        "2.3.1",
        "2.3.2",
        "2.3.3",
        "2.3.4",
        "2.3.5",
        "2.3.6",
        "2.3.7",
        "2.3.8",
        "2.4.0",
        "2.4.1",
        "2.4.2",
        "2.4.3",
        "3.0",
        "3.0.1",
        "3.0.10",
        "3.0.11",
        "3.0.12",
        "3.0.13",
        "3.0.14",
        "3.0.15",
        "3.0.16",
        "3.0.17",
        "3.0.18",
        "3.0.2",
        "3.0.3",
        "3.0.4",
        "3.0.5",
        "3.0.6",
        "3.0.7",
        "3.0.8",
        "3.0.9",
        "3.1.0",
        "3.1.0.b1",
        "3.1.0rc1",
        "3.1.0rc2",
        "3.1.1",
        "3.1.2",
        "3.1.3",
        "3.1.4",
        "3.1.5",
        "3.1.6",
        "3.1.7",
        "3.10.0",
        "3.10.0rc1",
        "3.10.0rc2",
        "3.10.1",
        "3.10.1rc1",
        "3.11.0",
        "3.11.1",
        "3.11.10",
        "3.11.11",
        "3.11.1rc1",
        "3.11.2",
        "3.11.3",
        "3.11.4",
        "3.11.5",
        "3.11.6",
        "3.11.7",
        "3.11.8",
        "3.11.9",
        "3.2.0",
        "3.2.1",
        "3.2.2",
        "3.2.3",
        "3.2.4",
        "3.2.5",
        "3.3.0",
        "3.3.0rc2",
        "3.3.0rc3",
        "3.3.0rc4",
        "3.3.1",
        "3.3.2",
        "3.3.3",
        "3.3.4",
        "3.4.0",
        "3.4.1",
        "3.4.2",
        "3.4.3",
        "3.4.4",
        "3.4.5",
        "3.4.6",
        "3.4.7",
        "3.5.0",
        "3.5.1",
        "3.5.2",
        "3.5.3",
        "3.5.4",
        "3.6.0",
        "3.6.0rc1",
        "3.6.0rc3",
        "3.6.1",
        "3.7.0",
        "3.7.0rc1",
        "3.7.0rc2",
        "3.7.1",
        "3.7.2",
        "3.7.3",
        "3.7.4",
        "3.8.0",
        "3.8.0rc1",
        "3.8.1",
        "3.8.2",
        "3.9.0",
        "3.9.0rc1",
        "3.9.0rc2",
        "3.9.0rc3",
        "4.1.0",
        "4.1.0rc1",
        "4.1.0rc2",
        "4.1.0rc3",
        "4.1.0rc4",
        "4.1.0rc5",
        "4.1.1",
        "4.1.10",
        "4.1.11",
        "4.1.2",
        "4.1.3",
        "4.1.4",
        "4.1.5",
        "4.1.6",
        "4.1.7",
        "4.1.9",
        "5.0.0",
        "5.0.0a1",
        "5.0.1",
        "5.0.2",
        "5.0.3",
        "5.0.4",
        "5.0.5",
        "5.0.6",
        "5.0.7"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54625",
    "GHSA-fwjf-m4qw-9f2x"
  ],
  "details": "### Summary\nThe CMS page cache key ignores the request headers that plugins declare via `get_vary_cache_on()`. The header is added to the response `Vary` header, but the CMS\u0027s own cache key does not incorporate the header values, so the first visitor\u0027s variant is served to all subsequent visitors regardless of their header values.\n\n### Details\n`_page_cache_key` (in `cms/cache/page.py`) keys only on cache prefix, site, language, path and timezone. `set_page_cache` collects the plugin-declared vary headers and calls `patch_vary_headers(response, ...)` (affecting only the emitted `Vary` header), but stores and retrieves the cached page under the header-agnostic key. `get_page_cache` therefore returns whichever variant was cached first.\n\n### Impact\n- **Information disclosure:** when a plugin varies its output on a request  header (e.g. `Country-Code`), the variant rendered for the first anonymous visitor is served to everyone until the entry expires, leaking request-specific content across users.\n- **Cache poisoning:** an unauthenticated attacker can prime the anonymous page cache with content rendered from attacker-chosen header values, which is then served to subsequent visitors.\n\nApplies only when `CMS_PAGE_CACHE` is enabled and at least one plugin implements `get_vary_cache_on()`.\n\n### Patches\nFixed in 5.0.8: the page cache now folds the request\u0027s values implements `get_vary_cache_on()`.\n\n### Patches\nFixed in 5.0.8: the page cache now folds the request\u0027s values for plugin-declared vary headers into the content key. The set of vary headers is persisted on write and looked up first on read (mirroring Django\u0027s  `learn_cache_key`/`get_cache_key`); a missing header-list entry degrades to a cache miss, never a wrong-variant hit.\n\n### Workarounds\nDisable `CMS_PAGE_CACHE`, or avoid plugins that rely on `get_vary_cache_on()`, until upgraded.\n\n### Credits\nReported by the security team at the University of Sydney ([@reporter]).",
  "id": "PYSEC-2026-3824",
  "modified": "2026-09-10T11:02:03.625718Z",
  "published": "2026-09-10T09:44:53.378969Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/django-cms/django-cms/security/advisories/GHSA-fwjf-m4qw-9f2x"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54625"
    },
    {
      "type": "WEB",
      "url": "https://github.com/django-cms/django-cms/pull/8646"
    },
    {
      "type": "WEB",
      "url": "https://github.com/django-cms/django-cms/pull/8647"
    },
    {
      "type": "WEB",
      "url": "https://github.com/django-cms/django-cms/commit/8758714b865ffa79c6bcd0e5c503958ea48885aa"
    },
    {
      "type": "WEB",
      "url": "https://github.com/django-cms/django-cms/commit/d5dc1efa18d157445491c4b12c2dd1efd56f439f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/django-cms/django-cms"
    },
    {
      "type": "WEB",
      "url": "https://github.com/django-cms/django-cms/releases/tag/5.0.8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/django-cms/django-cms/releases/tag/5.1.0"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/django-cms"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-fwjf-m4qw-9f2x"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "django CMS: Page cache ignores plugin-declared Vary headers (disclosure \u0026 poisoning)"
}

WID-SEC-W-2026-3001

Vulnerability from csaf_certbund - Published: 2026-08-24 22:00 - Updated: 2026-08-24 22:00

Summary

Django: Mehrere Schwachstellen

Severity

Mittel

Scope

2 vulnerabilities in this advisory, including CVE-2026-54625.

CVE-2026-54625

Known affected: 1 product

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-54625 (GCVE-0-2026-54625)

EUVD-2026-357053

FKIE_CVE-2026-54625

GHSA-FWJF-M4QW-9F2X

Summary

Details

Impact

Patches

Patches

Workarounds

Credits

PYSEC-2026-3824

Summary

Details

Impact

Patches

Patches

Workarounds

Credits

WID-SEC-W-2026-3001

Tags

Sightings

Nomenclature

Related by attack behaviour