CVE-2026-93455

Overview

django-page-cms through version 2.0.13 contains an authorization bypass vulnerability in its admin helper views. The flaw allows low-privilege staff accounts to read unpublished drafts, page listings, and stored media paths without proper permission validation. This matters because it exposes sensitive organizational content to internal users who should not have access.

Description

django-page-cms through 2.0.13 fails to properly validate page permissions in admin helper views, allowing any staff account to read arbitrary page content and stored media paths. Attackers with low-privilege staff credentials can enumerate content identifiers and access unpublished drafts, page listings, and file paths without proper authorization checks.

Impact

This vulnerability impacts the confidentiality of the application by allowing unauthorized access to unpublished drafts, internal page listings, and file storage paths. Integrity and availability are not directly affected by this specific read-only exposure. Organizations utilizing vulnerable versions with multiple low-privilege staff accounts are primarily at risk.

Remediation

Upgrade django-page-cms to a patched version beyond 2.0.13 when available, or apply vendor-supplied patches. Review and audit current staff account permissions to ensure principle of least privilege is enforced. Monitor administrative access logs for unusual enumeration activity targeting admin helper views.

Risk context

The vulnerability is rated as high severity with a CVSS v3 score of 6.5 and CVSS v4 score of 7.1. Although EPSS data is not currently present, the requirement of authenticated low-privilege staff credentials slightly reduces the immediate external exposure risk.

Affected products

• django-page-cms