django-page-cms Admin View Authorization Flaws

Forged content modification in django-page-cms through 2.0.13 lets unauthenticated remote attackers exploit five CSRF-exempt admin mutation views in pages/admin/views.py to store unescaped page content that then renders to every site visitor as stored cross-site scripting. The attack is unauthenticated from the attacker's side (CVSS vectors list PR:N) but requires user interaction: an authenticated editor or admin must be lured to attacker-controlled HTML while holding an active CMS session (UI:P), so this is a genuine but conditional risk rather than a drop-everything emergency. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and the secondary effects are bounded - the forged mutation only persists once a privileged victim's browser has sent the request successfully.

django-page-cms through 2.0.13 fails to enforce page-permission checks in its admin helper views, allowing low-privilege authenticated staff accounts to read arbitrary page content, unpublished drafts, listings, and stored media file paths. No write access or code execution is possible, and exploitation requires a valid Django admin staff login, confining the issue to insiders or compromised/over-provisioned staff accounts. No public exploit code or active exploitation has been identified at time of analysis, and the flaw is a bounded broken-access-control issue rather than a top-tier emergency.