django CMS: Plugin move endpoint allows cyclic reparenting (DoS)
Summary
| CVE | CVE-2026-54623 |
|---|---|
| State | PUBLISHED |
| Assigner | GitHub_M |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-08-20 18:16:28 UTC |
| Updated | 2026-08-20 19:16:55 UTC |
| Description | django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the move_plugin endpoint in cms/admin/placeholderadmin.py accepts an attacker-controlled plugin_parent value without rejecting a plugin’s own identifier or a descendant identifier. A staff user with plugin-change permission under CMS_PERMISSION can create a parent_id cycle in the plugin tree. The _get_descendants_cte and _get_ancestors_cte queries in cms/models/pluginmodel.py have no cycle guard, so get_descendants() and later rendering, copy, or delete operations can recurse indefinitely or reach a database recursion limit, corrupting the tree and consuming request workers. This issue is fixed in versions 5.0.8. |
Risk And Classification
Primary CVSS: v3.1 7.1 HIGH from [email protected]
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Problem Types: CWE-674 | CWE-835 | CWE-674 CWE-674: Uncontrolled Recursion | CWE-835 CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 7.1 | HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H |
| 3.1 | CNA | DECLARED | 7.1 | HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
NoneIntegrity
LowAvailability
HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Django-cms | Django-cms | affected < 5.0.8 | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/django-cms/django-cms/commit/7642a98ab3170793c0b27b4125dd1f3d... | [email protected] | github.com | |
| github.com/django-cms/django-cms/pull/8645 | [email protected] | github.com | |
| github.com/django-cms/django-cms/releases/tag/5.0.8 | [email protected] | github.com | |
| github.com/django-cms/django-cms/security/advisories/GHSA-8jj7-4v57-frf5 | [email protected] | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.