CVE-2026-93455: django-page-cms Auth Bypass Vulnerability

CVE-2026-93455 Overview

CVE-2026-93455 is a missing authorization vulnerability [CWE-862] affecting django-page-cms through version 2.0.13. The flaw resides in the admin helper views, which fail to validate page permissions before returning content. Any authenticated staff account, regardless of assigned page-level privileges, can read arbitrary page content and stored media paths. Attackers can enumerate content identifiers, retrieve unpublished drafts, list pages, and access file paths that should remain restricted.

Critical Impact
Low-privilege staff users can bypass page-level authorization to read unpublished drafts and stored media paths across the entire CMS.

Affected Products

django-page-cms versions through 2.0.13
Django deployments embedding the affected pages.admin.views module
Multi-tenant Django sites relying on staff-role separation for content isolation

Discovery Timeline

2026-09-18 - CVE-2026-93455 published to the National Vulnerability Database
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-93455

Vulnerability Analysis

The vulnerability affects admin helper endpoints in pages/admin/views.py that return page metadata, content, and media path information. These views authenticate the request against Django's staff role but do not enforce per-page permission checks defined by the CMS. As a result, authorization is reduced to a binary staff-or-not decision.

An authenticated staff user can query these endpoints to enumerate page identifiers, retrieve draft and published content, and disclose stored media paths. The disclosed data includes unpublished editorial material and internal file references that reveal storage layout. See the VulnCheck Advisory on Django Page CMS for the full advisory.

Root Cause

The root cause is missing authorization enforcement in the admin helper views. The relevant code paths at views.py L35-L36, L174-L178, and L226-L229 rely on a staff-only decorator and do not call the CMS has_page_permission checks before returning page data.

Attack Vector

Exploitation requires only low-privilege staff credentials and network access to the Django admin interface. An attacker iterates numeric page identifiers against the vulnerable helper endpoints and parses the JSON responses to harvest draft content, page listings, and media paths. Tracking of the issue is available in GitHub Issue #244.

No verified proof-of-concept code is available. Technical details are documented in the django-page-cms GitHub repository.

Detection Methods for CVE-2026-93455

Indicators of Compromise

Repeated sequential requests to /admin/pages/ helper endpoints from a single staff session, indicative of identifier enumeration.
Staff accounts accessing page identifiers outside their normal editorial scope in application logs.
Unexpected JSON responses containing draft content or media paths returned to non-privileged staff users.

Detection Strategies

Instrument pages/admin/views.py helper endpoints with per-request authorization audit logging that records the requesting user and target page identifier.
Correlate Django auth_user staff activity against page ownership records to flag cross-boundary access.
Alert on anomalous ratios of successful helper-endpoint responses per staff session over short time windows.

Monitoring Recommendations

Forward Django application and web server logs to a centralized analytics platform for retention and query.
Monitor for staff account creation and privilege changes that could be abused to reach the vulnerable endpoints.
Track HTTP 200 responses to admin helper URLs segmented by user role to detect over-privileged access patterns.

How to Mitigate CVE-2026-93455

Immediate Actions Required

Restrict Django admin interface reachability to trusted networks or VPN until a fixed release is deployed.
Audit and reduce the number of accounts holding the is_staff flag to the minimum required.
Rotate credentials for any staff account suspected of unauthorized enumeration activity.

Patch Information

No fixed release has been referenced in the advisory data at time of publication. Monitor the django-page-cms GitHub repository and GitHub Issue #244 for a patched version. Until a fix is available, apply local patches that add has_page_permission checks to the affected helper views.

Workarounds

Add explicit page-permission checks in the affected views before returning content, mirroring the checks used by the main admin change views.
Wrap the vulnerable endpoints with a custom Django middleware or decorator that enforces object-level authorization.
Remove or disable the helper endpoints in URL routing if they are not required by your deployment.

bash

# Configuration example
# Restrict admin access at the reverse proxy until a patch is available (nginx)
location /admin/ {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://django_upstream;
}