django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request headers declared by plugins through get_vary_cache_on(). The _page_cache_key function includes the cache prefix, site, language, path, and timezone but not the declared header values. Although set_page_cache adds those names to the response Vary header, get_page_cache retrieves the first stored variant under the same header-agnostic key. When CMS_PAGE_CACHE is enabled and a plugin varies content on a header such as Country-Code, one visitor can receive another visitor’s request-specific content, and an unauthenticated attacker can prime the cache with attacker-chosen content. This issue is fixed in versions 5.0.8 and 5.1.0.
CVE-2026-54625
This medium-severity CVE scores 4.8 under a secondary CVSS source (NVD's own analysis pending). EPSS exploit probability: 0.1%, top 96% of all CVEs by exploit prediction. GitHub Security Advisory data not yet ingested — confidence will rise once GHSA publishes (typical lag: hours to days for open-source ecosystem CVEs; never for infrastructure-only CVEs).
- Lower severity and no public exploit yet
No vendor fix yet — apply a workaround or compensating control (WAF / firewall / segmentation) and watch for a patch.
- CVSS v3
- 4.8
- EG Score
- 4.8(medium)
- EG Risk
- 22(Track)EG Risk 22/100SSVC: Track
EG Risk is EchelonGraph's 0–100 priority score: it fuses intrinsic severity with real-world exploitation and automatability so you can rank equal-severity CVEs and fix the most dangerous first. Higher = act sooner. Distinct from the 0–10 EG Score (severity).
How it’s computedSeverity48% × 45%Exploitation0% × 40%Automatability0% × 15%Action: Routine — remediate on your standard cadence. - EPSS PROB
- 0%
- EPSS %ILE
- 4%
- KEV
- Not listed
Published
August 20, 2026
Last Modified
August 20, 2026
Advisory Details (7)
Auto-updated Aug 20, 2026Page cache ignores plugin-declared Vary headers (disclosure & poisoning) · Advisory · django-cms/django-cms · GitHub
Affected: 5.0.8: the page cache now folds the request's values implements
https://github.com/django-cms/django-cms/security/advisories/GHSA-fwjf-m4qw-9f2x5.1.0
Patch available: django-cms/django-cms 5.1.0
https://github.com/django-cms/django-cms/releases/tag/5.1.05.0.8
Patch available: django-cms/django-cms 5.0.8
https://github.com/django-cms/django-cms/releases/tag/5.0.8fix: Honour plugin-declared Vary headers in the page cache key (#8646)
Patch available: django-cms/django-cms 5.0.8 (PR #8647 merged 2026-06-05)
https://github.com/django-cms/django-cms/pull/8647fix: Honour plugin-declared Vary headers in the page cache key
Patch available: django-cms/django-cms 5.1.0 (PR #8646 merged 2026-06-08)
https://github.com/django-cms/django-cms/pull/8646commit d5dc1efa18d1 (django-cms/django-cms)
Patch available: django-cms/django-cms 5.0.8 (contains commit d5dc1efa18d1)
https://github.com/django-cms/django-cms/commit/d5dc1efa18d157445491c4b12c2dd1efd56f439fcommit 8758714b865f (django-cms/django-cms)
Patch available: django-cms/django-cms 5.1.0 (contains commit 8758714b865f)
https://github.com/django-cms/django-cms/commit/8758714b865ffa79c6bcd0e5c503958ea48885aaVendor Advisories for CVE-2026-54625(1)
These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.
Affected Packages
(1 across 1 ecosystem)
PyPI(1)
| Package | Vulnerable range | Fixed in | Dependents |
|---|---|---|---|
| django-cms | 2.0.1 ... 5.0.7 (140 versions) | 5.0.8 | — |
Weakness Classification(2)
MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.
Data Freshness Timeline
(refreshed 12× in last 7d / 12× in last 30d)
Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.
- 2026-08-25 13:49 UTCEPSS rescore
- 2026-08-25 12:23 UTCEG score recompute
- 2026-08-24 13:55 UTCEG score recompute
- 2026-08-23 15:32 UTCEG score recompute
- 2026-08-23 00:19 UTCEPSS rescore
- 2026-08-22 17:08 UTCEG score recompute
- 2026-08-21 23:49 UTCEPSS rescore
- 2026-08-20 20:20 UTCEG score recompute
- 2026-08-20 19:52 UTCEG score recompute
- 2026-08-20 18:17 UTCEG score recompute
- 2026-08-20 18:07 UTCEG score recompute
- 2026-08-20 18:06 UTCMITRE cvelistV5first tracked
Frequently asked(5)
What is CVE-2026-54625?
When was CVE-2026-54625 disclosed?
Is CVE-2026-54625 actively exploited?
What is the CVSS score of CVE-2026-54625?
How do I remediate CVE-2026-54625?
Dependency Blast Radius
See which npm, PyPI, Go, and Maven packages are affected by CVE-2026-54625
Is Your Infrastructure Affected by CVE-2026-54625?
EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.