Django REST Framework CVE-2026-73229

Three concurrent conditions must hold for exploitation: (1) the DRF view must use AdminRenderer in its renderer_classes, which is active by default in development settings but must be explicitly retained in production; (2) the view must configure asymmetric permissions where the requesting user is permitted to call POST but denied GET on the same view (e.g., via a permission class like PostOnlyPermission as demonstrated in the patched test suite); and (3) the attacker must be authenticated with at least low-privilege credentials sufficient to submit POST requests (CVSS PR:L). The attacker controls the trigger by submitting any payload that fails validation. Exploitation is blocked in production deployments that restrict DEFAULT_RENDERER_CLASSES to JSON-only renderers (e.g., JSONRenderer), as AdminRenderer is never invoked. Scope is limited to the data returned by view.get() for the specific resource - no lateral movement or scope change occurs.

The CVSS 4.3 Medium score with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N accurately represents the bounded nature of this flaw: confidentiality impact only, no integrity or availability concern, and PR:L reflecting the mandatory authenticated write-access prerequisite. SSVC marks technical impact as partial and automatable as no, consistent with the prerequisite of a specific asymmetric permission configuration not present in all deployments. The vulnerability is not in CISA KEV, and EPSS data is not provided in the available intelligence, so exploitation probability cannot be quantified numerically. In practice, risk is elevated specifically for APIs that intentionally separate read and write access roles (e.g., audit-only accounts, append-only endpoints, or role-separated designs) - a common Django REST Framework pattern. In production environments where AdminRenderer is removed from DEFAULT_RENDERER_CLASSES (standard hardening guidance), the attack surface does not exist. This is a real but narrowly scoped finding, not a broadly critical exposure.

An attacker with a low-privilege account that holds POST but not GET access to a DRF endpoint backed by AdminRenderer deliberately submits a POST request with a payload that fails serializer validation, triggering a 400 Bad Request. The AdminRenderer renders the HTML error page by internally calling view.get() without re-checking permissions, and the attacker receives the full GET resource representation - including data they are explicitly denied read access to - embedded in the 400 response body. SSVC confirms POC-level exploitation capability exists, meaning this attack path has been demonstrated.