Permissions, Privileges, and Access Controls in Django - CVE-2026-25674

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU123482

Permissions, Privileges, and Access Controls in Django - CVE-2026-25674

Published: March 3, 2026


Vulnerability identifier: #VU123482
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-25674
CWE-ID: CWE-264
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to alter application behavior. 

The vulnerability exists due to incorrect permissions set for newly created directories. A local user can potentially write files into the directory before proper permissions are applied. 


Affected software

Django
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Fedora
SUSE Package Hub 15
openSUSE Leap
openEuler
Anolis OS
Storage Defender - Resiliency Service
python3-Django
python-django-help
python-django
python311-Django
python3-django
python3-django-bash-completion
python3-django-doc
python-django4.2
python-django5
python-django6

How to mitigate CVE-2026-25674

Install updates from vendor's website.

Django - addressed in versions 4.2.29, 5.2.12, 6.0.3
Storage Defender - Resiliency Service - update to 2.1.3
python3-Django - addressed in versions 2.2.27-22, 4.2.15-13
python-django-help - addressed in versions 2.2.27-22, 4.2.15-13
python-django - addressed in versions 2.2.27-22, 4.2.15-13
python311-Django - update to 4.2.11-150600.3.50.1
python3-django - update to 4.2.16-7
python3-django-bash-completion - update to 4.2.16-7
python3-django-doc - update to 4.2.16-7
python-django4.2 - update to 4.2.30-2.el9
python-django5 - addressed in versions 5.2.14-1.fc42, 5.2.14-1.fc43, 5.2.14-1.fc44
python-django6 - update to 6.0.5-1.fc44

External References

Related Security Bulletins