THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-8qj2-c6q4-f399 (medium) — django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff

[GHSA] GHSA-8qj2-c6q4-f399 (medium) — django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff

medgithub_advisoriesPublished 2026-08-20

GHSA-8qj2-c6q4-f399 Severity: medium CVE: CVE-2026-61663

django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff

## Summary

The django-cms frontend-editing structure endpoint

``` GET /<lang>/admin/cms/placeholder/object/<content_type_id>/structure/<object_id>/ ```

did not perform an object-level authorization check

Indicators of compromise

CVE-2026-61663cve

Original source: https://github.com/advisories/GHSA-8qj2-c6q4-f399