| Package | Affected versions | Patched versions |
|---|---|---|
| django-cms | < 5.0.9 | 5.0.9 |
The django-cms frontend-editing structure endpoint
GET /<lang>/admin/cms/placeholder/object/<content_type_id>/structure/<object_id>/
did not perform an object-level authorization check for non-PageContent objects. Any authenticated, active staff user could request the structure endpoint for a frontend-editable object (a model using PlaceholderRelationField) and read its placeholder/plugin structure, even without permission to change that object and without the cms.use_structure permission that the toolbar UI requires before offering structure mode.
PageContent objects were already protected (a page-view check added in GHSA/PR #8644); this advisory covers the remaining non-PageContent branch of the same view.
The issue is staff-gated and read-only, disclosing CMS structure metadata (placeholder slot names, plugin tree, plugin identifiers/labels, object existence) rather than write access or arbitrary field data.
>= 4.0.0, <= 5.0.x and 5.1.0a1
(the vulnerable non-PageContent branch was introduced with the frontend-editing endpoints in 4.0)is_staff=True).PageContent model with django-cms placeholders / frontend editing (e.g. via PlaceholderRelationField).content_type_id and object id.cms.use_structure permission.A low-privileged staff user can read the editorial placeholder/plugin structure of non-PageContent objects they are not authorized to edit through the toolbar. Depending on the installed plugins and templates this may reveal placeholder names, plugin layout, plugin identifiers and the existence of objects owned by other staff users or teams. This is most relevant for deployments using third-party or custom django-cms apps that expose frontend-editable objects outside the page tree.
Using django-cms' own test model placeholder_relation_field_app.FancyPoll (a non-PageContent model with a ):
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site freePlaceholderRelationFieldtarget = FancyPoll.objects.create(name="private-fancy-poll")
placeholder = rescan_placeholders_for_obj(target)["content"]
attacker = self._create_user("low_staff", is_staff=True, is_superuser=False)
# attacker has neither change_fancypoll nor cms.use_structure
with self.login_user_context(attacker):
response = self.client.get(get_object_structure_url(target, language="en"))
# Before fix: HTTP 200, body contains '"placeholder_id": "<pk>"'
# After fix: HTTP 404, structure not disclosed
render_object_structure now authorizes the non-PageContent branch, mirroring
Placeholder.has_change_permission at the object level (honouring a custom
has_placeholder_change_permission hook, otherwise falling back to the model/object
change permission) and returning 404 when the user is not authorized:
else:
content_type_obj = content_type.get_object_for_this_type(pk=object_id)
if not _can_change_placeholder_object(request.user, content_type_obj):
raise Http404
No configuration workaround. Deployments that do not register any non-PageContent
frontend-editable model are not affected. Otherwise, upgrade to a patched release.
Reported by doanmanhducz.