---
id: CVE-2026-54622
aliases:
  - GHSA-4xfr-4p46-gc6p
  - PYSEC-2026-3820
title: 'django CMS: Clipboard copy IDOR discloses unauthorized plugin content'
summary: 'django CMS: Clipboard copy IDOR discloses unauthorized plugin content'
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
vendor: django-cms
product: django-cms
ecosystem: pip
affected:
  - django-cms < 5.0.8
patched:
  - django-cms 5.0.8
published: '2026-08-20'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T12:26:06.115395390Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-4xfr-4p46-gc6p'
references:
  - url: >-
      https://github.com/django-cms/django-cms/security/advisories/GHSA-4xfr-4p46-gc6p
  - url: 'https://github.com/django-cms/django-cms/pull/8645'
  - url: >-
      https://github.com/django-cms/django-cms/commit/7642a98ab3170793c0b27b4125dd1f3d318b8a1c
  - url: 'https://github.com/django-cms/django-cms'
  - url: 'https://github.com/django-cms/django-cms/releases/tag/5.0.8'
  - url: 'https://pypi.org/project/django-cms'
  - url: 'https://github.com/advisories/GHSA-4xfr-4p46-gc6p'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54622'
tags:
  - osv
  - pip
  - nvd
  - ghsa
epss: 0.00415
epssPercentile: 0.3324
cwe:
  - CWE-639
ingestedAt: '2026-08-20T18:59:54.381Z'
---

## Overview

### Summary
  The clipboard copy paths of the `copy_plugins` admin endpoint validate only   the target (the user's own clipboard) and skip source-side authorization. A staff user can copy plugins out of a placeholder they have no permission on   into their clipboard, then read the (secret) content.

  ### Details
  In `cms/admin/placeholderadmin.py`, `_copy_plugin_to_clipboard` and   `_copy_placeholder_to_clipboard` check `has_copy_plugins_permission`, which only  evaluates `request.toolbar.clipboard.has_add_plugins_permission(...)` — the
  clipboard belongs to the requesting user, and `check_source` is likewise  applied only to the clipboard. The source placeholder identified by the  attacker-supplied `source_placeholder_id` / `source_plugin_id` is never  authorization-checked. (The placeholder-to-placeholder copy path,  `has_copy_from_placeholder_permission`, correctly checks both sides.)

  ### Impact
  A staff user holding the global add permission for a plugin type, but with no  access to a given placeholder/page, can copy that placeholder's plugins into  their own clipboard and read content (e.g. link names/URLs, text) they cannot  reach through the normal edit endpoints.

  Requires `CMS_PERMISSION=True` with per-placeholder/page restrictions.

  ### Patches
  Fixed in 5.0.8: the clipboard copy paths now also verify   source-side permission (`has_add_plugins_permission` + `check_source` on the  source placeholder), matching placeholder-to-placeholder copy.

  ### Workarounds
  None. Upgrade is recommended.

  ### Credits
  Reported by the security team at the University of Sydney ([@reporter]).

## Affected packages

- `django-cms < 5.0.8`

## Remediation

Upgrade to a patched release:

- `django-cms 5.0.8`