django CMS CVE-2026-54625

Two non-default conditions must both be true: (1) CMS_PAGE_CACHE must be explicitly enabled in Django settings - it is a configurable CMS option, not enabled by default in all deployment guides; (2) at least one CMS plugin installed on the target page must implement get_vary_cache_on() to declare that its rendered output varies on a specific request header. Without plugin-declared vary headers, the cache key mismatch has no exploitable effect because no header values are ever intended to differentiate cached responses. Exploitation is further limited to pages where such a plugin is placed - a CMS instance with the vulnerable configuration but no affected pages remains unexploitable in practice. No authentication, no user interaction, and no special network position are required once both prerequisites are met.

CVSS 4.8 Medium with vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N reflects accurate real-world risk. The AC:H designation is well-justified: exploitation requires CMS_PAGE_CACHE to be explicitly enabled AND at least one installed plugin to implement get_vary_cache_on() - neither condition is universal across django CMS deployments. Where those prerequisites are met, however, PR:N and UI:N mean any unauthenticated network attacker can prime the cache and cause cross-user content leakage without any victim interaction. No EPSS data was provided, and no CISA KEV listing exists, consistent with the configuration-dependency limiting mass exploitation. The dual-nature impact (C:L for reading others' content, I:L for cache poisoning) is real and not inflated. Defenders should treat this as a genuine priority specifically on instances running plugins that vary cache on sensitive headers such as country, language override, or user-tier indicators - and deprioritize it where no such plugins are deployed.

An attacker targeting a django CMS site with CMS_PAGE_CACHE enabled and a country-code-varying plugin sends a GET request to a cacheable page with a crafted Country-Code: ATTACKER header, priming the cache with the response rendered for that header value. A legitimate user from France who subsequently requests the same page receives the attacker's cached variant instead of their own localized content, resulting in both information disclosure (the attacker's chosen content leaks to real users) and content injection (the attacker's input appears in the page). No exploit code is publicly available, but the attack requires only standard HTTP tooling.