PT-2026-30870 · Djangoproject · Django

Cantina + 1 · Published 2026-04-07 · Updated 2026-04-07 · CVE-2026-4292

Mitre

CVSS v3.1

2.7

Low

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Admin changelist forms using ModelAdmin.list editable incorrectly allowed new instances to be created via forged POST data. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Cantina for reporting this issue.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-4292

Affected Products

Django

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-4292 · Security Note
• https://docs.djangoproject.com/en/dev/releases/security · Vendor Advisory
• https://djangoproject.com/weblog/2026/apr/07/security-releases · Vendor Advisory
• https://groups.google.com/g/django-announce · Note