[GHSA] GHSA-6x92-6vx4-5fwr (medium) — django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)

GHSA-6x92-6vx4-5fwr Severity: medium CVE: CVE-2026-63003

django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)

## Impact

The only authorization gate on the duplicate flow is `PageAdmin.has_add_permission`, which checks `user_can_add_page(user, site)` / `user_can_add_subpage(...)` — i.e. *“may this user create a page at all