GHSA-8qj2-c6q4-f399 django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff

• PyPI django-cms: < 5.0.9 → fixed in 5.0.9

Summary The django-cms frontend-editing structure endpoint ``` GET //admin/cms/placeholder/object//structure// ``` did not perform an object-level authorization check for non-`PageContent` objects. Any authenticated, active staff user could request the structure endpoint for a frontend-editable object (a model using `PlaceholderRelationField`) and read its placeholder/plugin structure, even without permission to change that object and without the `cms.use_structure` permission that the toolbar UI requires before offering structure mode. `PageContent` objects were already protected (a page-view check added in GHSA/PR #8644); this advisory covers the remaining non-`PageContent` branch of the same view. Severity The issue is staff-gated and read-only, disclosing CMS structure metadata (placeholder slot names, plugin tree, plugin identifiers/labels, object existence) rather than write access or arbitrary field data. Affected versions • django-cms `>= 4.0.0, "' After fix: HTTP 404, structure not disclosed ``` Patch `render_object_structure` now authorizes the non-`PageContent` branch, mirroring `Placeholder.has_change_permission` at the object level (honouring a custom `has_placeholder_change_permission` hook, otherwise falling back to the model/object change permission) and returning `404` when the user is not authorized: ```python else: content_type_obj = content_type.get_object_for_this_type(pk=object_id) if not _can_change_placeholder_object(request.user, content_type_obj): raise Http404 ``` Workarounds No configuration workaround. Deployments that do not register any non-`PageContent` frontend-editable model are not affected. Otherwise, upgrade to a patched release. Credit Reported by doanmanhducz.