~ / search / GHSA-mmwr-2jhp-mc7j

GHSA-mmwr-2jhp-mc7j

Django vulnerable to privilege abuse in ModelAdmin.list_editable

Source: GitHub Advisory Database (reviewed) Low CVE-2026-4292

Packages

EcosystemPackageAffectedFixed in
PyPI Django >= 6.0, < 6.0.4 6.0.4
PyPI Django >= 5.2, < 5.2.13 5.2.13
PyPI Django >= 4.2, < 4.2.30 4.2.30

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Admin changelist forms using `ModelAdmin.list_editable` incorrectly allowed new instances to be created via forged `POST` data. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Cantina for reporting this issue.

References

External links from the advisory. They lead to third-party sites.