PT-2026-30869 · Django+3 · Django+3

Jacob Walls + 1 · CVE-2026-4277 · Published 2026-04-07 · Updated 2026-07-14

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Django versions 6.0 through 6.0.3, 5.2 through 5.2.12, and 4.2 through 4.2.29

Description A flaw exists in the permission validation process for inline model instances within GenericInlineModelAdmin when handling forged POST data. This could allow unauthorized access or modification of data. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) may also be affected.

Recommendations Update to Django version 6.0.4 or later. Update to Django version 5.2.13 or later. Update to Django version 4.2.30 or later.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2026-07723

BIT-DJANGO-2026-4277

CVE-2026-4277

ECHO-400A-1B13-AE60

GHSA-PWJP-CCJC-GHWG

MGASA-2026-0093

OESA-2026-2216

OESA-2026-2217

OESA-2026-2218

OESA-2026-2219

OESA-2026-2220

OPENSUSE-SU-2026:10516-1

OPENSUSE-SU-2026:10517-1

OPENSUSE-SU-2026:10567-1

OPENSUSE-SU-2026:11270-1

OPENSUSE-SU-2026:20578-1

PYSEC-2026-52

SUSE-SU-2026:1740-1

USN-8154-1

USN-8154-2

Affected Products

Django

Linuxmint

Red Os

Ubuntu

References · 159

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4277.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-33034 · Security Note
• https://ubuntu.com/security/CVE-2026-33034 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2217 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-4277 · Security Note
• https://ubuntu.com/security/CVE-2026-4292 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2026-0093.html · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10516-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2216 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8154-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:11270-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-4277 · Security Note
• https://osv.dev/vulnerability/GHSA-pwjp-ccjc-ghwg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25674 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-5766 · Security Note