# CVE-2026-4292: Django privilege abuse in ModelAdmin.list_editable

Source: https://junglewise.ai/threats/cve-2026-4292-django-privilege-abuse-in-modeladmin-list-editable  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-07. Updated: 2026-06-06  
License: CC BY 4.0 with a link back

CVE-2026-4292 · Severity: low · CVSS 3.1 · Published 2026-04-07

A vulnerability in the Django web framework's administration interface could allow authorized staff members to create new database records they are not supposed to. Specifically, the 'list_editable' feature in the admin panel fails to properly restrict data submission, allowing users with high-level access to bypass intended workflows. While this requires existing administrative privileges, it could lead to unauthorized data entry and compromise the integrity of the application's records.

Technologies: [Djangoproject Django](https://junglewise.ai/threats/technologies/djangoproject-django), [Django (PyPI)](https://junglewise.ai/threats/technologies/django). Vendors: [Djangoproject](https://junglewise.ai/threats/vendors/djangoproject), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-4292 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-4292 being exploited in the wild.

**How severe is CVE-2026-4292?** Low severity, with a CVSS score of 3.1, published 7 April 2026.

**Which products and versions are affected?** Django (PyPI) ECOSYSTEM:introduced=4.2,fixed=4.2.30,introduced=5.2,fixed=5.2.13,introduced=6.0,fixed=6.0.4, ECOSYSTEM:introduced=6.0,fixed=6.0.4.

**Is there a fix for CVE-2026-4292?** Yes. Django (PyPI): upgrade to 6.0.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-4292 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-4292?** Check whether you run Djangoproject Django or Django (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Django (PyPI): upgrade to 6.0.4 or later

  ```sh
  pip install "Django>=6.0.4"
  ```


## Technical details

A missing authorization check (CWE-862) exists in Django's ModelAdmin.list_editable feature. When a changelist form is configured with list_editable, the application incorrectly processes forged POST data, allowing the creation of new model instances instead of only editing existing ones. An attacker must have high-level administrative privileges (PR:H) to access the admin changelist. By crafting a malicious POST request, an authenticated staff user can bypass intended restrictions to insert unauthorized data into the database. The issue is resolved in versions 6.0.4, 5.2.13, and 4.2.30.

## Affected products

- Django Software Foundation Django >= 6.0, < 6.0.4
- Django Software Foundation Django >= 5.2, < 5.2.13
- Django Software Foundation Django >= 4.2, < 4.2.30

## Identifiers

- CVE-2026-4292
- GHSA-mmwr-2jhp-mc7j
- PYSEC-2026-53

## Timeline

- 2026-04-07: disclosed
- 2026-04-07: advisory
- 2026-04-07: patched

## References

- [https://docs.djangoproject.com/en/dev/releases/security](https://docs.djangoproject.com/en/dev/releases/security)
- [https://groups.google.com/g/django-announce](https://groups.google.com/g/django-announce)
- [https://www.djangoproject.com/weblog/2026/apr/07/security-releases](https://www.djangoproject.com/weblog/2026/apr/07/security-releases)
- [https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-53.yaml](https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-53.yaml)

## Related threats

- [Django GeoDjango unbounded recursion denial of service](https://junglewise.ai/threats/cve-2026-15830-django-geodjango-unbounded-recursion-denial-of-service)
- [Django GeoDjango spatial lookups file write and request forgery](https://junglewise.ai/threats/cve-2026-15307-django-geodjango-spatial-lookups-file-write-and-request-forgery)
- [PYSEC-2026-2449 - Django has a Race Condition vulnerability](https://junglewise.ai/threats/cve-2026-25674-django-has-a-race-condition-vulnerability)
- [PYSEC-2026-1296 - Django vulnerable to partial directory traversal via archives](https://junglewise.ai/threats/cve-2025-59682-django-vulnerable-to-partial-directory-traversal-via-archives)
- [Django DomainNameValidator header injection via newline characters](https://junglewise.ai/threats/cve-2026-53878-django-domainnamevalidator-header-injection-via-newline)