CVE-2026-54622

Executive Summary

CVE-2026-54622 is an authorization bypass vulnerability in django CMS, an open-source enterprise content management system built on the Django web framework. Versions prior to 5.0.8 contain an improper authorization flaw (CWE-639) in the clipboard copy functionality accessible via the administrative interface. A staff user with only global add permissions for a plugin type can copy plugins from unauthorized pages or placeholders into their clipboard, thereby exfiltrating sensitive content including secret text, link names, and URLs. The vulnerability has a CVSS base score of 6.5 (High severity) with a network attack vector and high confidentiality impact, but no impact on integrity or availability. The fix is claimed to be delivered in version 5.0.8, though patch confirmation is rated 2/4 and derives from a single source (OSV) not yet independently verified.

Technical Analysis

Vulnerability Class: CWE-639 — Authorization Bypass Through User-Controlled Key. This class of vulnerability occurs when an application uses a user-supplied identifier (e.g., an ID, key, or parameter) to directly reference an object, without verifying that the requesting user is authorized to access that specific object.

Affected Component: The copy_plugins endpoint located in cms/admin/placeholderadmin.py. This is the only explicitly named file in the NVD description. The endpoint is part of django CMS's administrative interface, which is typically reachable by authenticated staff users over HTTP(S).

Vulnerability Mechanism: The NVD description specifies the following technical details:

1. Authorization Scope Misalignment: The copy_plugins endpoint authorizes only the destination clipboard (the requesting user's own clipboard) but does not validate the source placeholder or plugin. This is the core flaw — the authorization check is applied asymmetrically.

2. Affected Code Paths: Two internal paths are named: _copy_plugin_to_clipboard and _copy_placeholder_to_clipboard. Both accept source_placeholder_id and source_plugin_id values from the requesting client.

3. Incomplete Authorization Checks: The code uses has_copy_plugins_permission and check_source — but only against the requesting user's clipboard, not against the source placeholder that contains the target plugin. This means authorization is confirmed for where the data is going but not for where the data is coming from.

4. Privilege Requirement: The vulnerability is exploitable specifically when CMS_PERMISSION is enabled (the permission framework for django CMS). An attacker must be a staff user (authenticated with staff status) and hold the global add permission for a plugin type. This is a low-privilege requirement (CVSS PR:L).

5. Data Exfiltration: By crafting a request with a source_placeholder_id pointing to a placeholder on a page the attacker cannot otherwise access, the attacker's clipboard will receive the plugin content. This enables reading of secret text, link names, and URLs stored within plugins on unauthorized pages.

Attack Surface: The administrative interface of django CMS. The endpoint is reachable over the network (CVSS AV:N). Authentication is required (staff account), but no special — only a low-privileged add permission for a plugin type.

The NVD description contains no information about request formatting, HTTP methods, authentication token schemes, or CSRF protections. Insufficient technical detail is available to confirm whether CSRF protections apply to this endpoint, whether it is GET or POST based, or whether rate limiting exists.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class and the specific details in the NVD description.

Step 1 — Reconnaissance / Target Identification:

• The attacker identifies a django CMS instance and determines it is running a version prior to 5.0.8. Version disclosure may come from HTTP response headers, the admin login page, the Django debug toolbar (if enabled), or the django-cms static asset paths.
• The attacker obtains or possesses valid staff credentials. The privilege needed is low: staff status plus the global add permission for at least one plugin type (e.g., the default text/plugin types that ship with django CMS or a common third-party plugin). This permission is commonly granted to content editors, making it a realistic starting point.
• The attacker verifies that CMS_PERMISSION is enabled (the configuration that makes the vulnerability exploitable, per the description).

Step 2 — Triggering the Flaw:

• The attacker accesses the copy_plugins endpoint in cms/admin/placeholderadmin.py (the only endpoint named in the description).
• The attacker crafts an HTTP request to the _copy_plugin_to_clipboard or _copy_placeholder_to_clipboard path, supplying:
  • Their own clipboard as the destination (this passes the authorization check for the destination clipboard), and
  • A source_placeholder_id and/or source_plugin_id that points to a placeholder or plugin on a page for which the attacker lacks read permission.

Step 3 — Payload / Execution Method (Vulnerability-Class Level):

• This is an authorization bypass through user-controlled keys (CWE-639). The attacker does not need to inject code; they simply manipulate object identifiers (placeholder IDs, plugin IDs) in the request to reference objects outside their authorization scope.
• The application's internal logic executes the copy operation using the supplied source IDs, and because the source placeholder is not validated against has_copy_plugins_permission or check_source (per the description), the copy proceeds.

Step 4 — Post-Exploitation Impact:

• The plugin (and its content) lands in the attacker's clipboard.
• The attacker can then read the content — specifically cited in the description as: secret text, link names, and URLs.
• The attacker can repeat the operation for multiple source_plugin_id values, systematically harvesting content across all placeholders they can enumerate.
• The confidentiality impact is rated High (C:C in CVSS). Integrity and availability are unaffected (I:N, A:N), making this a pure information disclosure vulnerability.

Impact Assessment

Business Impact:

• Confidentiality Breach: The vulnerability allows cross-page/placeholder information disclosure. Any content stored within django CMS plugins that is intended to be restricted to authorized page editors can be read by any staff user holding global add permissions. This includes pragmatic business data such as internal links, placeholder text for pages under embargo, unpublished content, credentials or secrets stored in plugin fields (if administrators misuse plugins to store such data), and internal URL schemes.
• Compliance: If the disclosed content constitutes personally identifiable information (PII), protected health information (PHI), or payment-related data, the organization may face regulatory exposure (GDPR, HIPAA, PCI-DSS, etc.).
• Trust: A CMS is the editorial backbone of an enterprise. An internal user bypassing page-level permissions undermines the entire permission model and can erode trust in the CMS governance process.

Affected Systems:

• All django CMS installations running versions prior to 5.0.8 with CMS_PERMISSION enabled.
• The vulnerability requires the admin interface to be reachable (default for all django CMS deployments) and a staff account to exist.

Blast Radius:

• Scope (CVSS S:U): The impact is contained to the CMS application and its database; the vulnerability does not pivot to the underlying host or other applications.
• Attack Complexity (AC:L): No special conditions beyond the described permissions are required; the attack is straightforward.
• User Interaction (UI:N): No victim interaction is needed.
• CVSS Score: 6.5 (Medium-High). The high confidentiality impact drives the score, tempered by the low privilege requirement.

Detection Guidance

Sigma Rule

title: django CMS Copy Plugin Authorization Bypass Attempt (CVE-2026-54622)
id: 4f8e6d2a-9c51-4b0e-83f2-1a7b9c0d3e5f
status: experimental
description: Detects anomalous requests to django CMS copy_plugins endpoint with source placeholder/plugin IDs that may indicate attempted cross-page copy (CVE-2026-54622).
logsource:
    category: webserver
    product: apache
    definition: 'Requires web server access logs covering the django CMS admin URL path.'
detection:
    selection:
        cs-uri-path|contains:
            - '/admin/cms/placeholder/copy_plugins'
            - '/admin/cms/page/copy_plugins'
    filter_baseline:
        cs-uri-query|contains|all:
            - 'source_placeholder_id'
            - 'clipboard'
    condition: selection and not filter_baseline
    timeframe: 5m
level: medium
falsepositives:
    - Legitimate clipboard copy operations by users with full page edit permissions. Tune by correlating with user permission groups.
fields:
    - c-ip
    - cs-username
    - cs-uri-query
tags:
    - attack.t1190
    - cve.2026-54622
    - cwe.639

YARA Rule

rule django_cms_copy_plugins_auth_bypass_cve_2026_54622
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects log or payload patterns indicative of CVE-2026-54622 copy_plugins authorization bypass in django CMS"
        cve = "CVE-2026-54622"
        cwe = "CWE-639"
        date = "2026-01-01"
        reference = "NVD: CVE-2026-54622"
        score = 65
    strings:
        $a1 = "copy_plugins" ascii wide nocase
        $a2 = "source_placeholder_id" ascii wide
        $a3 = "source_plugin_id" ascii wide
        $b1 = "_copy_plugin_to_clipboard" ascii wide
        $b2 = "_copy_placeholder_to_clipboard" ascii wide
        $b3 = "placeholderadmin" ascii wide nocase
        $c1 = "has_copy_plugins_permission" ascii wide
        $c2 = "check_source" ascii wide
    condition:
        (uint16(0) == 0x5A4D or uint16(0) == 0x7F45) and
        (all of ($a*) or all of ($b*)) and
        (any of them) and
        (any of ($c*))
}

Note: This YARA rule is designed for binary/script scanning where django CMS source or compiled payloads are inspected. For pure log analysis, adjust to match $a* strings being present in the same log line.

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-54622 - django CMS copy_plugins Authorization Bypass Attempt"; flow:established,to_server; content:"copy_plugins"; http_uri; nocase; content:"source_placeholder_id"; http_uri; nocase; http_method; content:"POST"; http_method; pcre:"/.(?:source_placeholder_id|source_plugin_id)=[^&]+/Ui"; classtype:attempted-recon; reference:cve,2026-54622; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-54622; sid:202654622; rev:1;)

Elastic Detection

// Detect repeated requests to django CMS copy_plugins endpoint with source placeholder IDs
// from a single user, potentially indicating cross-page enumeration (CVE-2026-54622)
sequence by user.name with maxspan=10m
  [network where event.action == "request" and
     url.path in ("/admin/cms/placeholder/copy_plugins", "/admin/cms/page/copy_plugins") and
     url.query contains "source_placeholder_id"]
  [network where event.action == "request" and
     url.path in ("/admin/cms/placeholder/copy_plugins", "/admin/cms/page/copy_plugins") and
     url.query contains "source_placeholder_id"]
| unique source_placeholder_id values -> high_count > 5

Splunk SPL Query

index=web sourcetype=access_combined
| where match(uri_path, "(?i)copy_plugins") AND match(uri_query, "source_placeholder_id")
| eval source_ph = extract_field(uri_query, "source_placeholder_id")
| stats count, values(source_ph) as source_ids, dc(source_ph) as unique_sources
       by src_ip, user, uri_path
| where unique_sources > 5 OR count > 20
| table _time, src_ip, user, uri_path, count, unique_sources, source_ids
| sort - count
| rename comment as "Potential CVE-2026-54622 enumeration: single user hitting multiple source placeholders via copy_plugins"

Wazuh OSSEC Rule

<group name="django_cms,">
    <rule id="100622" level="10">
        <if_sid>31100</if_sid> <!-- Web server 403/error baseline -->
        <match>copy_plugins</match>
        <regex>source_placeholder_id|source_plugin_id</regex>
        <description>CVE-2026-54622: Possible django CMS copy_plugins authorization bypass — multiple references to source placeholder/plugin IDs in request.</description>
        <group>authentication_failures,</group>
        <mitre>
            <id>T1190</id>
        </mitre>
        <options>no_full_log</options>
    </rule>
    <rule id="100623" level="12" frequency="8" timeframe="300">
        <if_matched_sid>100622</if_matched_sid>
        <description>CVE-2026-54622: High frequency of copy_plugins requests from same source — scripted enumeration likely.</description>
        <group>attack,</group>
        <mitre>
            <id>T1190</id>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED). The patch availability is claimed by a single source (OSV) and not yet independently verified. Version 5.0.8 is reported to fix the issue. Affected version data is incomplete ([] in the supplied data), so the full impacted range is not confirmed — only "prior to 5.0.8" is stated in the description.

1) Immediate Mitigations (before patch):

• Restrict Admin Access: Place the django CMS admin interface behind an IP allowlist, VPN, or reverse proxy with additional authentication (SSO/MFA) to reduce the pool of reachable attackers.
• Audit Staff Permissions: Review all staff accounts that hold the global add permission for any plugin type. Where CMS_PERMISSION must be enabled, reduce the set of users with this permission to the minimum necessary.
• Disable CMS_PERMISSION (if feasible): The vulnerability is explicitly exploitable "Under CMS_PERMISSION" — if the granular permission framework is not strictly required, disabling it may prevent exploitation. (This is a configuration change and may alter access control behavior; test in staging.)
• Monitor Admin Logs: Activate the Sigma/Splunk/Elastic detections above. Pay attention to copy_plugins requests with non-self source_placeholder_id values.

2) Patch / Upgrade Steps:

• Confirm the patched version with the vendor or OSV advisory before deploying. Given the 2/4 patch confidence, verify the changelog contains a reference to CVE-2026-54622.
• Upgrade django CMS to version 5.0.8 or newer in a staging environment. Run the full test suite, particularly any tests covering placeholder admin operations and clipboard functionality.
• After deployment, re-run permission tests: verify that a staff user with global add permission cannot copy a plugin from a placeholder on a page where they lack access.

3) Long-Term Hardening:

• Adopt a least-privilege model for all CMS users. The global "add plugin" permission should never be granted casually; it is a high-risk privilege in django CMS when CMS_PERMISSION is enabled.
• Enable and audit the admin audit log (django CMS provides admin logging; ensure it is shipped to a central SIEM).
• Regularly update django CMS to the latest minor release. Monitor OSV and the django CMS security page for advisory disclosures.
• Consider a WAF rule to block copy_plugins requests where the source_placeholder_id differs from what the requesting user has accessed in a prior session (behavioral detection).
• Perform a post-patch penetration test specifically targeting the placeholder admin endpoints.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-54622 — Official NVD description and CVSS scoring (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, Base Score 6.5).
2. OSV Advisory: https://osv.dev/vulnerability/CVE-2026-54622 — Source of patch claim (django CMS fixed in 5.0.8). Not independently confirmed; verify against vendor release notes.
3. django CMS Official Site: https://www.django-cms.org/ — Vendor project page; consult release notes/changelog for version 5.0.8 to confirm patch scope.
4. django CMS GitHub (Placeholder Admin Source): https://github.com/django-cms/django-cms/blob/main/cms/admin/placeholderadmin.py — The affected source file named in the NVD description (cms/admin/placeholderadmin.py). Useful for code review of the fix.
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — Checked: Not listed (CISA KEV: NO). No evidence of active exploitation in the wild at the time of writing.

Threat Actor / Exploit-in-the-Wild Evidence: None available. PoC/exploit status is UNKNOWN (no public PoC, no Nuclei template, no exploit code identified). No threat actor campaigns attributed to this CVE are known.