CVE-2026-93456

Overview

django-page-cms up to version 2.0.13 improperly exempts five admin mutation views from Cross-Site Request Forgery (CSRF) protection in pages/admin/views.py. This flaw allows attackers to trick authenticated editors into executing unauthorized state-changing requests, leading to stored cross-site scripting (XSS) that affects all visitors.

Description

django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection in pages/admin/views.py, allowing attackers to forge requests that modify page content. Signed-in editors visiting a malicious page can be tricked into storing unescaped content that renders to all visitors, enabling stored cross-site scripting attacks.

Impact

The vulnerability impacts the integrity and availability of web applications using the affected package, potentially compromising content management workflows and end-user trust. Successful exploitation leads to compromised page content via stored XSS, affecting all users who view the altered pages. Authenticated editors and administrators are primarily at risk of being manipulated into performing unintended mutations.

Remediation

Upgrade django-page-cms to a patched version beyond 2.0.13 where CSRF protection is properly enforced on the affected admin mutation views. Review administrative audit logs for unexpected content modifications and ensure strict browser security policies, such as Content Security Policy (CSP), are deployed to mitigate XSS impact.

Risk context

The vulnerability carries a high severity rating with a CVSS v3 score of 8.2 and CVSS v4 score of 8.4, indicating significant risk to content management integrity. Although EPSS data is currently unavailable, defenders should prioritize remediation due to the high likelihood of exploitation against authenticated administrative users.

Affected products

• django-page-cms