Executive brief
A vulnerability in the Django web framework's administration interface could allow authorized staff members to create new database records they are not supposed to. Specifically, the 'list_editable' feature in the admin panel fails to properly restrict data submission, allowing users with high-level access to bypass intended workflows. While this requires existing administrative privileges, it could lead to unauthorized data entry and compromise the integrity of the application's records.
Technical details
A missing authorization check (CWE-862) exists in Django's ModelAdmin.list_editable feature. When a changelist form is configured with list_editable, the application incorrectly processes forged POST data, allowing the creation of new model instances instead of only editing existing ones. An attacker must have high-level administrative privileges (PR:H) to access the admin changelist. By crafting a malicious POST request, an authenticated staff user can bypass intended restrictions to insert unauthorized data into the database. The issue is resolved in versions 6.0.4, 5.2.13, and 4.2.30.
Affected products
- Django Software Foundation Django >= 6.0, < 6.0.4
- Django Software Foundation Django >= 5.2, < 5.2.13
- Django Software Foundation Django >= 4.2, < 4.2.30
Timeline
- 2026-04-07: disclosed
- 2026-04-07: advisory
- 2026-04-07: patched