CVE-2026-73229: Django REST framework AdminRenderer permission bypass information disclosure

CVE-2026-73229 · Severity: medium · CVSS 4.3 · Published 2026-08-11

Django REST framework's AdminRenderer component fails to properly enforce GET request permissions when rendering error responses for invalid write requests (POST, PUT, etc.). An attacker with permission to submit write requests but not read data can trigger a 400 Bad Request error that causes the renderer to invoke the view's GET handler without permission checks, exposing sensitive data in the HTML error page that should normally be inaccessible.

Technologies: Django Software Foundation Django REST framework, djangorestframework (PyPI). Vendors: Django Software Foundation, PyPI.

Quick answers

Is CVE-2026-73229 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-73229 being exploited in the wild.
How severe is CVE-2026-73229?
Medium severity, with a CVSS score of 4.3, published 11 August 2026.
Which products and versions are affected?
Django Software Foundation Django REST framework <= 3.17.1; djangorestframework (PyPI) <= 3.17.1, ECOSYSTEM:introduced=0,fixed=3.17.2.
Is there a fix for CVE-2026-73229?
Yes. djangorestframework (PyPI): upgrade to 3.17.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73229 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-73229?
Check whether you run Django Software Foundation Django REST framework or djangorestframework (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • djangorestframework (PyPI): upgrade to 3.17.2 or later
    pip install "djangorestframework>=3.17.2"

Technical details

The vulnerability exists in Django REST framework's AdminRenderer, which handles rendering of error responses. When rendering a 400 Bad Request response for an invalid write request, AdminRenderer temporarily overrides the request method to "GET" and directly invokes the view's GET handler (view.get(...)) to retrieve a representation for the error page. Critically, this direct invocation bypasses the normal request processing flow (APIView.dispatch() → APIView.initial() → check_permissions()), allowing the GET handler to execute even when the request's permissions would normally deny GET access. The vulnerability requires: (1) AdminRenderer enabled, (2) client requesting HTML via Accept: text/html header, (3) view permitting write methods (POST/PUT/PATCH/DELETE), (4) GET requests denied by permission class, (5) invalid write request generating 400 response, and (6) GET representation containing sensitive data. The fix involves performing permission checks before executing the simulated GET, avoiding invocation when GET would be denied, or falling back to validation-error-only rendering. Patch available in version 3.17.2.

Affected products

  • Django Software Foundation Django REST framework <= 3.17.1

Identifiers

  • CVE-2026-73229
  • GHSA-g47c-3xmw-q6m2
  • PYSEC-2026-3828

Timeline

  • 2026-09-01: disclosed
  • 2026-09-01: patched: Fixed in version 3.17.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.