CVE-2026-93455 describes a missing authorization vulnerability in django-page-cms through version 2.0.13. The product fails to properly validate page permissions in its admin helper views, enabling any staff account to bypass intended access controls. This allows unauthorized reading of arbitrary page content and stored media paths, including unpublished drafts and page listings. The vulnerability is exploitable by attackers with low-privilege staff credentials who can enumerate content identifiers to access sensitive data without proper authorization.

The vulnerability allows unauthorized disclosure of unpublished page content, drafts, page listings, and stored media paths to any staff user. This could lead to information leakage within the affected system. There is no indication of privilege escalation or remote code execution. The CVSS 4.0 score of 7.1 reflects a high severity due to network attack vector, low attack complexity, and no required user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict staff account privileges to trusted users only and monitor for unauthorized access to admin helper views. Avoid granting staff credentials to untrusted parties.