This vulnerability in django CMS is not a broken authorization check — it's an absent one. The render_object_structure view, which serves the page structure preview for the CMS toolbar, simply never calls user_can_view_page(). The function exists and works correctly elsewhere in the CMS; it just wasn't invoked here. The fix is a single line, which might suggest a simple oversight, but the pattern is more instructive than that: authorization in django CMS is a manual step developers must remember, not a framework-level enforcement that makes omission impossible.
The exposure is more serious than the CVSS 6.5 rating suggests. The view doesn't merely leak placeholder layout and plugin ordering — it exposes get_short_description() values from plugins, including link names, URLs, and text content. This crosses the line from structural disclosure to functional disclosure. An unauthorized staff member can learn that a restricted page contains a 'Settlement Agreements' plugin linking to /legal/hr/, revealing content categories, navigation paths, and internal URLs that were never intended for broader audiences. Structural disclosure tells you the building layout; metadata disclosure tells you what's inside each room.
The configuration dependency creates a counter-intuitive security interaction. The vulnerability requires CMS_PERMISSION enabled with view restrictions or CMS_PUBLIC_FOR set to staff. This means enabling stricter permission controls in one context actually expands structural access in another — staff who might be blocked from viewing restricted content can access its structure through this bypass. This is exactly the kind of permission model complexity that creates both vulnerabilities and developer confusion.
There's also a temporal dimension worth considering. A one-line fix doesn't mean the exposure lasted one line of effort — if this view existed across multiple django CMS versions before detection, that's years of latent exposure. Worse, the patch itself becomes archaeological evidence: it reveals the vulnerability class to attackers, who can now search for other views that don't call permission checks. Every other view in that file without user_can_view_page() becomes a candidate by subtraction.
For defenders: patch to 5.0.8 immediately. Beyond that, audit any custom plugins or third-party django CMS extensions that render structured content — they likely inherit the same architectural assumption that structure views don't need view-level authorization checks. Treat any internal toolbar endpoint that survived into production as a candidate for similar exposure. The CVSS captures a severity snapshot; the real risk includes the exposure window length and the new attack surface created by public disclosure.