Incorrect authorization in Django - CVE-2026-87975

Vulnerability details

The vulnerability allows a remote attacker to delete instances outside the limiting queryset or create instances through edit-only formsets.

The vulnerability exists due to improper authorization enforcement in Django model formsets when processing submitted data for models whose primary keys can be set through the form. A remote attacker can submit forged POST data to delete instances outside the limiting queryset or create instances through edit-only formsets.

Affected configurations include a OneToOneField or parent link used as the primary key of an inline formset's model, or a natural or UUID primary key included in the form's fields. Models using the default BigAutoField primary key are not affected.

Affected software

How to mitigate CVE-2026-87975

External References

• https://www.djangoproject.com/weblog/2026/oct/06/security-releases/
• https://github.com/django/django/commit/83cbd21be57483e6b3eb6e4688a561c841aff75e

Related Security Bulletins

• Multiple vulnerabilities in Django