PT-2026-30870 · Django+3 · Django+3

Cantina + 1 · Published 2026-04-07 · Updated 2026-05-13 · CVE-2026-4292

Positive Technologies (AI Summary)

CVSS v3.1

2.7

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Django versions 6.0 through 6.0.3 Django versions 5.2 through 5.2.12 Django versions 4.2 through 4.2.29 Django versions 5.0.x and earlier Django versions 4.1.x and earlier Django versions 3.2.x and earlier

Description An issue was discovered where admin changelist forms using ModelAdmin.list editable incorrectly allowed new instances to be created via forged POST data. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.

Recommendations Update to Django version 6.0.4 or later. Update to Django version 5.2.13 or later. Update to Django version 4.2.30 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BIT-DJANGO-2026-4292

CVE-2026-4292

GHSA-MMWR-2JHP-MC7J

MGASA-2026-0093

OESA-2026-2216

OESA-2026-2217

OESA-2026-2218

OESA-2026-2219

OESA-2026-2220

OPENSUSE-SU-2026:10516-1

OPENSUSE-SU-2026:10517-1

OPENSUSE-SU-2026:10567-1

OPENSUSE-SU-2026:20578-1

PYSEC-2026-53

USN-8154-1

USN-8154-2

Affected Products

Django

Linuxmint

Red Os

Ubuntu

References · 61

• https://osv.dev/vulnerability/MGASA-2026-0093 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-4277 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-4292 · Security Note
• https://osv.dev/vulnerability/OESA-2026-2218 · Vendor Advisory
• https://docs.djangoproject.com/en/dev/releases/security · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2219 · Vendor Advisory
• https://djangoproject.com/weblog/2026/apr/07/security-releases · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2220 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-django-2026-4292 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2217 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-4292 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-5766 · Security Note
• https://ubuntu.com/security/CVE-2026-33033 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20578-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2026-0093.html · Security Note