django-page-cms through 2.0.13 fails to properly validate page permissions in admin helper views, allowing any staff account to read arbitrary page content and stored media paths. Attackers with low-privilege staff credentials can enumerate content identifiers and access unpublished drafts, page listings, and file paths without proper authorization checks.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products
batiste:django-page-cms
References 6
https://github.com/batiste/django-page-cms/issues/244
GitHub Issue #244
https://github.com/batiste/django-page-cms
NVD
https://github.com/batiste/django-page-cms/blob/bc4cbe6c187d2d4573289c5695ce8de…
get_content() resolves Content by content_id alone, ignoring page_id, behind @staff_member_required only
https://github.com/batiste/django-page-cms/blob/bc4cbe6c187d2d4573289c5695ce8de…
get_media_url() returns any stored media path by media_id behind @staff_member_required only
https://github.com/batiste/django-page-cms/blob/bc4cbe6c187d2d4573289c5695ce8de…
list_pages_ajax() renders the full page listing behind @staff_member_required with no has_perm('pages.change_page') gate, as do get_last_content (L121), traduction (L156) and sub_menu (L210)
https://www.vulncheck.com/advisories/django-page-cms-through-2.0.13-unauthorize…
VulnCheck Advisory: django-page-cms through 2.0.13 Unauthorized Content Access via Staff Account