CVE-2026-54623 django-cms CVE debrief

Who should care

Defenders responsible for systems using django CMS, especially those with staff users having plugin-change permission, should assess exposure and verify the version being used. They should also review the plugin tree for potential parent_id cycles and consider upgrading to django CMS version 5.0.8 or later to fix the issue. Additionally, defenders should monitor system performance and database queries for potential recursion limit issues and review compens

Why it matters

CVE-2026-54623 allows staff users with plugin-change permission to create a parent_id cycle in the plugin tree, potentially leading to database recursion limit issues and tree corruption. Defenders should prioritize verifying exposure and assessing the impact on their systems, especially those using django CMS versions prior to 5.0.8.

• Potential database recursion limit issues due to parent_id cycles in the plugin tree.
• Tree corruption and consumption of request workers.
• Need for verification of exposure and impact on systems using django CMS versions prior to 5.0.8.
• Potential for denial-of-service due to excessive database queries.

Technical summary

The move_plugin endpoint in cms/admin/placeholderadmin.py accepts an attacker-controlled plugin_parent value without rejecting a plugin's own identifier or a descendant identifier. This allows a staff user with plugin-change permission to create a parent_id cycle in the plugin tree, potentially leading to database recursion limit issues and tree corruption. The _get_descendants_cte and _get_ancestors_cte queries in cms/models/pluginmodel.py have no cycle guard, which can cause get_descendants() and later rendering, copy, or delete operations to recurse indefinitely or reach a database recursion limit. To address this issue, defenders should prioritize verifying exposure and assessing the impact on their systems

Defensive priority

Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems, especially those using django CMS versions prior to 5.0.8.

Recommended defensive actions

• Verify if the system uses django CMS and assess the version being used.
• Check if staff users have plugin-change permission and if there are any potential parent_id cycles in the plugin tree.
• Consider upgrading to django CMS version 5.0.8 or later to fix the issue.
• Monitor system performance and database queries for potential recursion limit issues.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. However, the corpus does not establish versions, exploitation, impact, or remediation beyond the provided information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.