PT-2026-30869 · Django+3 · Django+3

Jacob Walls + 1 · Published 2026-04-07 · Updated 2026-05-13 · CVE-2026-4277

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Django versions 6.0 through 6.0.3, 5.2 through 5.2.12, and 4.2 through 4.2.29

Description A flaw exists in the permission validation process for inline model instances within GenericInlineModelAdmin when handling forged POST data. This could allow unauthorized access or modification of data. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) may also be affected.

Recommendations Update to Django version 6.0.4 or later. Update to Django version 5.2.13 or later. Update to Django version 4.2.30 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BIT-DJANGO-2026-4277

CVE-2026-4277

GHSA-PWJP-CCJC-GHWG

MGASA-2026-0093

OESA-2026-2216

OESA-2026-2217

OESA-2026-2218

OESA-2026-2219

OESA-2026-2220

OPENSUSE-SU-2026:10516-1

OPENSUSE-SU-2026:10517-1

OPENSUSE-SU-2026:10567-1

OPENSUSE-SU-2026:20578-1

PYSEC-2026-52

USN-8154-1

USN-8154-2

Affected Products

Django

Linuxmint

Red Os

Ubuntu

References · 61

• https://osv.dev/vulnerability/MGASA-2026-0093 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-4277 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-4277 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2218 · Vendor Advisory
• https://docs.djangoproject.com/en/dev/releases/security · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2219 · Vendor Advisory
• https://djangoproject.com/weblog/2026/apr/07/security-releases · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2220 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2217 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-5766 · Security Note
• https://ubuntu.com/security/CVE-2026-33033 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-4277 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:20578-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2026-0093.html · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10567-1 · Vendor Advisory