What is the CVSS score of CVE-2026-4292?

CVE-2026-4292 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-4292?

Yes, a patch is available for CVE-2026-4292. Update the affected software to the latest version immediately.

Python CVE-2026-4292

EUVD-2026-19688 LOW

Missing Authorization (CWE-862)

2026-04-07 DSF

GHSA-mmwr-2jhp-mc7j

Authentication Bypass Python

2.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Apr 07, 2026 - 21:31 nvd

Patch available

EUVD ID Assigned

Apr 07, 2026 - 15:00 euvd

EUVD-2026-19688

Analysis Generated

Apr 07, 2026 - 15:00 vuln.today

CVE Published

Apr 07, 2026 - 14:22 nvd

LOW 2.7

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

16 pypi packages depend on django (16 direct, 0 indirect)

Ecosystem-wide dependent count for version 6.0.

DescriptionCVE.org

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Admin changelist forms using ModelAdmin.list_editable incorrectly allowed new instances to be created via forged POST data. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Cantina for reporting this issue.

AnalysisAI

Django admin changelist forms with ModelAdmin.list_editable enabled allow high-privileged users to create new instances via forged POST requests, bypassing intended access controls. Affects Django 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30; unsupported versions 5.0.x, 4.1.x, and 3.2.x may also be vulnerable. The vulnerability requires admin-level privileges and results in unauthorized data modification rather than data exposure or availability impact. No public exploit code or active exploitation has been confirmed at time of analysis.

Technical ContextAI

Django's ModelAdmin.list_editable feature allows inline editing of model instances in the admin changelist view. The vulnerability stems from insufficient authorization checks (CWE-862: Missing Authorization) when processing POST requests to create new objects through this interface. The root cause is that Django's admin form processing did not properly validate whether the authenticated admin user possessed explicit permission to create new instances when using list_editable, relying instead on a blanket high-privilege assumption. This affects Django's Object-Relational Mapping (ORM) and admin interface authorization layer across multiple version branches: the 6.x series (CPE: cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*), with specific vulnerability windows in 6.0.0-6.0.3, 5.2.0-5.2.12, and 4.2.0-4.2.29. Earlier unsupported series (5.0.x, 4.1.x, 3.2.x) lack vendor testing but may contain the same logic flaw.

RemediationAI

Upgrade Django to version 6.0.4 or later (for 6.0.x users), 5.2.13 or later (for 5.2.x users), or 4.2.30 or later (for 4.2.x users). The Django Software Foundation has released patched versions addressing the authorization bypass in ModelAdmin.list_editable forms. Users on unsupported Django versions (5.0.x, 4.1.x, 3.2.x) should upgrade to the nearest supported stable branch (4.2 LTS is the recommended migration path for 3.2.x users). No temporary workaround is provided; patching is the required remediation. Refer to the official Django Security Release page at https://www.djangoproject.com/weblog/2026/apr/07/security-releases/ and the Django release notes at https://docs.djangoproject.com/en/dev/releases/security/ for detailed migration guidance.