This CVE exposes a fundamental flaw in authorization boundary design within django CMS's clipboard functionality. The copy_plugins endpoint validates that you can write to your destination clipboard but never checks whether you have any right to read from the source. This treats content as accessible by default unless the destination is protected — when it should be protected by default unless you have source rights.
The vulnerability becomes exploitable through a specific permission configuration: staff users with global 'add' permission for a plugin type can copy any plugin of that type from any page into their own clipboard, regardless of ownership. The CMS_PERMISSION framework conflates add permission (a creation right) with the implicit ability to read content for workflow purposes. A staff user anywhere in the permission hierarchy can exfiltrate plugin content from protected pages into their clipboard, then paste it into unauthorized locations or hold it for later use.
For defenders running django CMS 5.0.x before 5.0.8, the immediate action is upgrading. But the deeper question is whether this pattern — validating only the destination of a read-write operation — exists elsewhere. Review endpoints involving plugin move, duplicate, or transform operations for symmetric source-destination authorization checks. The clipboard itself was architecturally positioned outside the permission model as a user-space convenience feature; audit other clipboard-adjacent operations for similar gaps.
The CVSS 6.5 may understate risk in deployments where global add permissions are commonly granted. The EPSS of 0.00239 suggests low automated exploitation, but the real exposure window depends on how quickly your organization patches and whether staff users have broad plugin permissions. In typical enterprise deployments with 90-180 day patch lag, this vulnerability likely persisted unpatched for months before discovery.