{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/django-cms-5.0.x/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-54623"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["django CMS (5.0.x)"],"_cs_severities":["medium"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["django CMS"],"content_html":"\u003cp\u003eThe django CMS application is vulnerable to a denial-of-service (DoS) condition stemming from an improper validation of the \u003ccode\u003emove_plugin\u003c/code\u003e administrative endpoint (CVE-2026-54623). An authenticated user with sufficient permissions to modify plugins can purposefully move a plugin to be a child of one of its own descendants. Because the underlying recursive SQL queries used to calculate ancestors and descendants lack cycle detection or recursion depth limits, this creates an infinite loop in the database worker process. This vulnerability affects django CMS versions prior to 5.0.8. When an attacker induces this state, any subsequent request attempting to render, copy, or delete the affected plugin tree will hang, leading to application worker exhaustion and potential service outage.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker authenticates to the django CMS dashboard with staff-level permissions.\u003c/li\u003e\n\u003cli\u003eAttacker identifies a target plugin tree within a placeholder.\u003c/li\u003e\n\u003cli\u003eAttacker triggers the \u003ccode\u003emove_plugin\u003c/code\u003e functionality via the administrative interface.\u003c/li\u003e\n\u003cli\u003eAttacker sends a specially crafted POST request to \u003ccode\u003emove_plugin\u003c/code\u003e with the \u003ccode\u003eplugin_parent\u003c/code\u003e parameter targeting a child or descendant of the currently moved plugin.\u003c/li\u003e\n\u003cli\u003eThe application backend accepts the request without validating the cyclic dependency.\u003c/li\u003e\n\u003cli\u003eThe backend updates the database, setting the \u003ccode\u003eparent_id\u003c/code\u003e and creating a closed-loop structure in the plugin tree.\u003c/li\u003e\n\u003cli\u003eAttacker triggers a legitimate action (e.g., viewing the page, editing the tree) that calls \u003ccode\u003eget_descendants()\u003c/code\u003e or \u003ccode\u003eget_ancestors()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe database engine executes an unconstrained \u003ccode\u003eWITH RECURSIVE\u003c/code\u003e CTE, causing the application thread to hang and eventually exhausting worker capacity (DoS).\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in a persistent denial-of-service condition for the affected placeholder. The application becomes unresponsive for any administrative or front-end operation involving the corrupted plugin tree. The vulnerability requires authenticated access, limiting the scope to internal users or accounts with plugin-change permissions; however, it allows for targeted service disruption within the CMS environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for detection and mitigation:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003ePatch the django CMS installation to version 5.0.8 or later to incorporate the required cycle validation logic in the \u003ccode\u003emove_plugin\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eAudit logs for administrative users performing high-frequency or anomalous \u003ccode\u003emove_plugin\u003c/code\u003e POST requests that might indicate attempts to manipulate the plugin tree structure.\u003c/li\u003e\n\u003cli\u003eMonitor application web server logs for HTTP 500 or timeout errors occurring specifically during administrative plugin operations, which may indicate the presence of cyclic tree corruption.\u003c/li\u003e\n\u003cli\u003eRestrict \u003ccode\u003eCMS_PERMISSION\u003c/code\u003e and plugin-change permissions to a minimal set of trusted administrative accounts to reduce the threat surface.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-24T21:57:51Z","date_published":"2026-08-24T21:57:51Z","id":"https://feed.craftedsignal.io/briefs/2026-08-django-cms-dos/","summary":"An authenticated user with plugin-change permissions can exploit the move_plugin endpoint in django CMS to create cyclic tree structures, causing resource exhaustion and denial of service during recursive SQL operations.","title":"Denial of Service via Cyclic Plugin Reparenting in django CMS","url":"https://feed.craftedsignal.io/briefs/2026-08-django-cms-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Django CMS (5.0.x)","version":"https://jsonfeed.org/version/1.1"}