Vulnerability · Published Apr 7, 2026 · Assigned by DSF
CVE-2026-4292Privilege abuse in ModelAdmin.list_editable
Low 2.7
In plain English
A low-severity missing authorization in Django from djangoproject. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Admin changelist forms using `ModelAdmin.list_editable` incorrectly allowed new instances to be created via forged `POST` data. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Cantina for reporting this issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.23 | py3-django | 4.2.30-r0 | ALPINE-CVE-2026-4292 |
| Alpine:v3.24 | py3-django | 5.2.13-r0 | ALPINE-CVE-2026-4292 |
| Debian:12 | python-django | no fix listed | DEBIAN-CVE-2026-4292 |
| Debian:13 | python-django | no fix listed | DEBIAN-CVE-2026-4292 |
| Debian:14 | python-django | 3:4.2.30-1 | DEBIAN-CVE-2026-4292 |
| PyPI | django | 6.0.4 | GHSA-mmwr-2jhp-mc7j |
| PyPI | django | 5.2.13 | GHSA-mmwr-2jhp-mc7j |
| PyPI | django | 4.2.30 | GHSA-mmwr-2jhp-mc7j |
| PyPI | django | 4.2.30, 5.2.13, 6.0.4 | PYSEC-2026-53 |
| Ubuntu:22.04:LTS | python-django | 2:3.2.12-2ubuntu1.26 | USN-8154-1 |
| Ubuntu:22.04:LTS | python-django | 2:3.2.12-2ubuntu1.26 | UBUNTU-CVE-2026-4292 |
| Ubuntu:24.04:LTS | python-django | 3:4.2.11-1ubuntu1.15 | USN-8154-1 |
| Ubuntu:24.04:LTS | python-django | 3:4.2.11-1ubuntu1.15 | UBUNTU-CVE-2026-4292 |
| Ubuntu:25.10 | python-django | 3:5.2.4-1ubuntu2.4 | UBUNTU-CVE-2026-4292 |
| Ubuntu:25.10 | python-django | 3:5.2.4-1ubuntu2.4 | USN-8154-1 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| djangoproject | Django | 6.0 – before 6.0.45.2 – before 5.2.134.2 – before 4.2.30 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
References
- Django security archive vendor-advisory
- Django releases announcements mailing-list
- Django security releases issued: 6.0.4, 5.2.13, and 4.2.30 vendor-advisory