EUVD-2026-19687
GHSA-pwjp-ccjc-ghwg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious POST request with forged data
-
DeliverySubmit to GenericInlineModelAdmin endpoint
-
ExploitBypass permission validation
-
ExecutionExecute unauthorized model operations
-
ImpactAchieve arbitrary code execution or data manipulation
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Remote unauthenticated attacker can exploit Django admin's GenericInlineModelAdmin by submitting forged POST data. Affects Django 6.0 before 6.0.4, 5.2 before 5.2.13, 4.2 before 4.2.30, and unsupported series 5.0.x, 4.1.x, 3.2.x. Requires Django admin interface accessible and GenericInlineModelAdmin in use. |
| Impact | Critical permission bypass in Django's GenericInlineModelAdmin affecting unauthenticated attackers. CVSS 9.8 reflects maximum severity (network-exploitable, no auth required, complete confidentiality/integrity/availability loss). EPSS 0.01% indicates minimal observed real-world exploitation despite high theoretical impact. Vendor patch available mitigates risk substantially for maintained versions; unsupported Django series present extended exposure window. |
| Exploit ScenarioDerived | Attacker crafts forged POST request to GenericInlineModelAdmin endpoint with malicious inline model data, bypassing permission validation. No authentication required (PR:N). Successful submission grants unauthorized add permissions on inline instances, potentially modifying application data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 07, 2026
Unauthenticated attackers can bypass add permissions in Django GenericInlineModelAdmin (versions 6.0 <6.0.4, 5.2 <5.2.13, 4.2 <4.2.30) by submitting forged POST data to inline model forms. Permission checks fail to validate creation rights on inline model instances, enabling unauthorized database record insertion with network access alone. CVSS 9.8 critical severity reflects complete confidentiality, integrity, and availability impact. No public exploit identified at time of analysis. Low observed exploitation activity (EPSS 0.01%).
RemediationAI
Vendor-released patches: upgrade to Django 6.0.4, 5.2.13, or 4.2.30 immediately. Organizations maintaining unsupported Django versions should prioritize migration to supported releases or backport permission validation logic from patches. If immediate upgrade is infeasible, disable or remove GenericInlineModelAdmin usage until patching completes, and audit recent inline model submissions for unauthorized records. Official security advisory: https://www.djangoproject.com/weblog/2026/apr/07/security-releases/ and detailed release notes: https://docs.djangoproject.com/en/dev/releases/security/. Ubuntu users reference USN-8154-1: https://ubuntu.com/security/notices/USN-8154-1.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-862 missing authorization flaw in GenericInlineModelAdmin form processing. Django's inline model admin fails to enforce add permissions during POST submission validation, allowing permission boundary bypass through direct form manipulation. Affects Python-based Django applications using generic inline admin classes.
Know when Django gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: DSF
Lifecycle Timeline
2DescriptionCVE.org
An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Add permissions on inline model instances were not validated on submission of forged POST data in GenericInlineModelAdmin. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank N05ec@LZU-DSLab for reporting this issue.
Blast Radius
ecosystem impact- 18 pypi packages depend on django (18 direct, 0 indirect)
Ecosystem-wide dependent count for version 6.0.
Executive ViewAI
Django GenericInlineModelAdmin in versions 6.0, 5.2, and 4.2 contains a critical permission bypass vulnerability that allows unauthenticated attackers to create unauthorized database records by submitting forged POST requests, directly compromising data integrity and potentially enabling unauthorized data insertion across any Django application using affected versions.
Apply vendor patch. No interim mitigations provided-immediate patching is required due to unauthenticated attack vector and critical CVSS score.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in Django Security Multiple Issues
View all 5The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9
In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for
An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. Rated critical severity (CVSS 9.8), this vulne
Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input
Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. Rated critical severity (CVSS 9.8
An authentication/authorization bypass in the djust Python live-view framework (versions prior to 1.0.7) lets unauthenti
Unauthenticated arbitrary Python module import in djust before 1.0.7 lets any client that can reach the WebSocket or SSE
Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a
Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/j
Forged content modification in django-page-cms through 2.0.13 lets unauthenticated remote attackers exploit five CSRF-ex
Cross-site request forgery in djust's Server-Sent-Events transport affects all versions prior to 1.0.7 and allows a cros
Unauthenticated remote attackers can read live Django view and session state and invoke server-side handlers through dju
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | Fixed |
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
Exploit-DB