Improper access control in Django - CVE-2026-4292

Vulnerability identifier: #VU125095

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-4292

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to create new instances through admin changelist forms.

The vulnerability exists due to improper access control in ModelAdmin.list_editable when processing forged POST data. A remote user can submit forged POST data to create new instances through admin changelist forms.

Django
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
Fedora
Ubuntu
SUSE Package Hub 15
openSUSE Leap
openEuler
Anolis OS
python-django (Ubuntu package)
python-django
python3-Django
python-django-help
python311-Django
python3-django-doc
python3-django-bash-completion
python3-django
python-django4.2
python-django5
python-django6

Install security update from vendor's website.

Django - addressed in versions 4.2.30, 5.2.13, 6.0.4
python-django (Ubuntu package) - addressed in versions 1.6.11-0ubuntu1.3+esm11, 1.8.7-1ubuntu5.15+esm12, 1:1.11.11-1ubuntu1.21+esm15, 2:2.2.12-1ubuntu0.29+esm8, 2:3.2.12-2ubuntu1.26, 3:4.2.11-1ubuntu1.15, 3:5.2.4-1ubuntu2.4
python-django - addressed in versions 2.2.27-22, 4.2.15-15
python3-Django - addressed in versions 2.2.27-22, 4.2.15-15
python-django-help - addressed in versions 2.2.27-22, 4.2.15-15
python311-Django - update to 4.2.11-150600.3.56.1
python3-django-doc - update to 4.2.30-1
python3-django-bash-completion - update to 4.2.30-1
python3-django - update to 4.2.30-1
python-django4.2 - update to 4.2.30-2.el9
python-django5 - addressed in versions 5.2.14-1.fc42, 5.2.14-1.fc43, 5.2.14-1.fc44
python-django6 - update to 6.0.5-1.fc44

• https://www.djangoproject.com/weblog/2026/apr/07/security-releases/

• Multiple vulnerabilities in Django
• Ubuntu update for python-django
• Ubuntu update for python-django
• Anolis OS update for python-django
• SUSE update for python-Django
• openEuler 24.03 LTS SP3 update for python-django
• openEuler 24.03 LTS SP1 update for python-django
• openEuler 24.03 LTS update for python-django
• openEuler 22.03 LTS SP4 update for python-django
• openEuler 20.03 LTS SP4 update for python-django
• Fedora 44 update for python-django6
• Fedora 43 update for python-django5
• Fedora 44 update for python-django5
• Fedora 42 update for python-django5
• Fedora EPEL 9 update for python-django4.2