django CMS Clipboard Copy IDOR Vulnerability: Early Warning
- Severity
- HIGH
- Affected component
- django CMS (pypi)
- Patched version
- 5.0.8
An IDOR vulnerability has been reported in the clipboard copy paths of the `copy_plugins` admin endpoint in django CMS. This vulnerability may allow staff users to copy plugins from unauthorized placeholders into their clipboard.
What happened
An IDOR vulnerability has been identified in the clipboard copy paths of the `copy_plugins` admin endpoint in django CMS. This vulnerability reportedly allows staff users to copy plugins from unauthorized placeholders into their clipboard. The issue arises because the endpoint validates only the target user's clipboard and skips source-side authorization. This is under investigation and has not been exploited in the wild.
The vulnerability affects django CMS versions prior to 5.0.8. The recommended action is to upgrade to version 5.0.8 or later to mitigate the risk. The issue was first flagged on 2026-08-20T18:42:11+00:00 and is tracked under GHSA-4XFR-4P46-GC6P.
What to do about it
- Identify the version of django CMS currently in use.
- Upgrade django CMS to version 5.0.8 or later to mitigate the IDOR vulnerability.
- Test the upgraded environment to ensure that the vulnerability has been addressed.
- Monitor the primary sources for any updates or additional information related to this vulnerability.
How 0Day would have caught this
django CMS is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using django CMS version prior to 5.0.8.
What should I do right now?
Upgrade django CMS to version 5.0.8 or later to mitigate the IDOR vulnerability.
Has this been exploited in the wild?
No, this vulnerability has not been exploited in the wild.