django-tastypie CVE-2026-16208

Exploitation requires a valid authenticated user account with API access (PR:L per CVSS vector). The vulnerable code path is only active when the application explicitly configures CacheThrottle or CacheDBThrottle as the throttling class for a tastypie resource - deployments that use no throttling or a custom throttle implementation are unaffected. The attacker must be capable of sending multiple concurrent HTTP requests (not sequential), and successful exploitation depends on winning a cache read-modify-write race condition (AC:H), which is non-trivial and timing-dependent. Exploitation is bounded by the limited impact scope: it does not yield code execution, authentication bypass, or access to resources beyond what the authenticated account already permits. The absence of a subsequent-system scope change (SC:N/SI:N/SA:N) means impact is contained within the tastypie application's own throttle state.

The CVSS 4.0 score of 2.3 accurately reflects a low-priority vulnerability. The high attack complexity (AC:H) is the dominant risk-reducing factor: reliable exploitation requires precise timing of concurrent requests to consistently win the race condition in the cache backend, making casual or opportunistic exploitation impractical. The low-privilege requirement (PR:L per CVSS vector) restricts the attack surface to authenticated API consumers, eliminating unauthenticated exploitation scenarios. Impact is uniformly low across all three CIA dimensions (VC:L/VI:L/VA:L) with no subsequent-system effects (SC:N/SI:N/SA:N), meaning successful exploitation yields throttle bypass and possible minor data exposure - not remote code execution or privilege escalation. No EPSS data was provided in the source intelligence, no CISA KEV listing exists, and no public exploit code has been identified. The E:X (exploit maturity not defined) CVSS 4.0 supplemental metric confirms exploit status is unconfirmed. The primary realistic risk is to applications where rate limiting is a load-bearing security control rather than a convenience feature; in those deployments the integrity impact (throttle circumvention) is disproportionately higher than the raw score suggests.

An authenticated API consumer sends a burst of 50 parallel HTTP requests to a rate-limited django-tastypie endpoint configured with CacheThrottle, timed so that all threads read the current throttle counter before any write completes. Each thread independently evaluates the count as below the threshold and proceeds, effectively multiplying permitted request volume by the degree of concurrency. No public exploit code is known, and consistent exploitation requires careful control of request concurrency and network timing under AC:H conditions.