django-page-cms CVE-2026-93455

Requires a valid authenticated Django admin staff account with low privileges (PR:L) - the attacker must already be able to log into the admin interface; there is no unauthenticated path. Once authenticated, exploitation targets the page admin helper views in pages/admin/views.py that omit page-permission checks, so no special non-default configuration is needed beyond running django-page-cms through 2.0.13 with more than one staff user of differing privilege. Limiting factors: the staff-credential prerequisite confines this to insiders or compromised/over-provisioned staff accounts, and impact is confined to disclosure of page content, drafts, listings, and media file paths (no write, no code execution).

This is a genuine but bounded issue, not a top-tier emergency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N = 7.1) is internally consistent with the description: a confidentiality-only broken-access-control flaw (CWE-862) exploitable over the network by an already-authenticated low-privilege staff account, with no integrity or availability impact. The single most important limiting signal is PR:L - this is NOT unauthenticated; the attacker must already hold valid staff credentials to the Django admin, which materially narrows the population of real-world attackers to insiders or holders of compromised staff logins. No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis' - there is no evidence of active exploitation or automation. The VC:H (confidentiality high) rating is arguably aggressive: the exposed assets are CMS page content, unpublished drafts, page listings, and stored media file paths, which is meaningful information disclosure but not credentials or secrets; a case can be made for VC:L/C:L. Note also the 'Authentication Bypass' tag conflicts with the actual mechanism - CWE-862 is a missing-authorization (post-authentication) flaw, not an auth bypass. Net: a real, patch-worthy authorization defect, but the authentication precondition and confidentiality-only, no-KEV/no-EPSS/no-POC profile place it below internet-facing unauthenticated flaws in priority.

An attacker with (or having phished/compromised) a low-privilege Django staff account logs into the admin, then calls the page admin helper views (pages/admin/views.py) which fail to check page-level permissions. By enumerating content identifiers they retrieve arbitrary page content, unpublished drafts, page listings, and stored media file paths they were never authorized to see. No public exploit code is identified at time of analysis; exploitation is straightforward given the low attack complexity (AC:L) once staff access exists.