What is the CVSS score of CVE-2026-73229?

CVE-2026-73229 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-73229?

Yes, a patch is available for CVE-2026-73229. Update the affected software to the latest version immediately.

Django REST Framework CVE-2026-73229

EUVD-2026-56888 MEDIUM

Information Exposure (CWE-200)

2026-08-11 security-advisories@github.com

Python Information Disclosure Red Hat Suse

4.3

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-reachable via POST; PR:L because authenticated write access is required; confidentiality only, as no data is modified or service disrupted.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 MEDIUM

qualitative

Primary rating from Vendor (github).

CVSS VectorVendor: github

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Aug 11, 2026 - 23:27 vuln.today

Analysis Generated

Aug 11, 2026 - 23:27 vuln.today

Patch available

Aug 11, 2026 - 20:34 EUVD

CVE Published

Aug 11, 2026 - 20:18 cve.org

MEDIUM 4.3

DescriptionCVE.org

Django REST framework is a powerful and flexible toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's rest_framework/renderers.py AdminRenderer.render() uses override_method() to simulate GET and directly invokes view.get() without view.check_permissions() while rendering an invalid write request, allowing a 400 Bad Request HTML response to disclose data from a GET representation that the requester is not permitted to access. This issue is fixed in version 3.17.2.

AnalysisAI

AdminRenderer in Django REST Framework prior to 3.17.2 discloses unauthorized GET resource data to authenticated users who hold write-but-not-read permissions on a DRF view. When a POST request fails validation and returns a 400 Bad Request, the renderer internally calls view.get() without first invoking view.check_permissions(), embedding the full GET representation in the HTML error response visible to the requester. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Authenticate with low-privilege write-capable account

Delivery

Identify DRF endpoint with AdminRenderer and asymmetric GET/POST permissions

Exploit

Craft POST payload that deliberately fails serializer validation

Execution

Submit invalid POST to trigger 400 Bad Request

Persist

AdminRenderer calls view.get() without permission check

Impact

Exfiltrate GET resource data embedded in HTML error response

Access

Authenticate with low-privilege write-capable account

Delivery

Identify DRF endpoint with AdminRenderer and asymmetric GET/POST permissions

Exploit

Craft POST payload that deliberately fails serializer validation

Execution

Submit invalid POST to trigger 400 Bad Request

Persist

AdminRenderer calls view.get() without permission check

Impact

Exfiltrate GET resource data embedded in HTML error response

Vulnerability AssessmentAI

Exploitation	Three concurrent conditions must hold for exploitation: (1) the DRF view must use AdminRenderer in its renderer_classes, which is active by default in development settings but must be explicitly retained in production; (2) the view must configure asymmetric permissions where the requesting user is permitted to call POST but denied GET on the same view (e.g., via a permission class like PostOnlyPermission as demonstrated in the patched test suite); and (3) the attacker must be authenticated with at least low-privilege credentials sufficient to submit POST requests (CVSS PR:L). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.3 Medium score with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N accurately represents the bounded nature of this flaw: confidentiality impact only, no integrity or availability concern, and PR:L reflecting the mandatory authenticated write-access prerequisite. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker with a low-privilege account that holds POST but not GET access to a DRF endpoint backed by AdminRenderer deliberately submits a POST request with a payload that fails serializer validation, triggering a 400 Bad Request. The AdminRenderer renders the HTML error page by internally calling view.get() without re-checking permissions, and the attacker receives the full GET resource representation - including data they are explicitly denied read access to - embedded in the 400 response body. …
Remediation	Upgrade django-rest-framework to version 3.17.2, the vendor-released patch that resolves this issue (https://github.com/encode/django-rest-framework/releases/tag/3.17.2). … Detailed patch versions, workarounds, and compensating controls in full report.