MEDIUM

CVE-2026-93455

2026-09-18 CVSS v3.1

CVSS

6.5

Description

django-page-cms through 2.0.13 fails to properly validate page permissions in admin helper views, allowing any staff account to read arbitrary page content and stored media paths. Attackers with low-privilege staff credentials can enumerate content identifiers and access unpublished drafts, page listings, and file paths without proper authorization checks.

Weakness (CWE)

CWE-862 Missing Authorization

EPSS Score

0.26%

Probability of exploitation in next 30 days

17.8th percentile

References

https://github.com/batiste/django-page-cms https://github.com/batiste/django-page-cms/blob/bc4cbe6c187d2d4573289c5695ce8dec0556994d/pages/admin/views.py#L174-L178 https://github.com/batiste/django-page-cms/blob/bc4cbe6c187d2d4573289c5695ce8dec0556994d/pages/admin/views.py#L226-L229 https://github.com/batiste/django-page-cms/blob/bc4cbe6c187d2d4573289c5695ce8dec0556994d/pages/admin/views.py#L35-L36 https://github.com/batiste/django-page-cms/issues/244 https://www.vulncheck.com/advisories/django-page-cms-through-2.0.13-unauthorized-content-access-via-staff-account

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE