Junglewise Threat Intelligence

CVE-2026-73229: Django REST framework AdminRenderer permission bypass information disclosure

CVE-2026-73229 · Severity: medium · CVSS 4.3 · Published 2026-09-01

Executive brief

Django REST framework's AdminRenderer component fails to properly enforce GET request permissions when rendering error responses for invalid write requests (POST, PUT, etc.). An attacker with permission to submit write requests but not read data can trigger a 400 Bad Request error that causes the renderer to invoke the view's GET handler without permission checks, exposing sensitive data in the HTML error page that should normally be inaccessible.

Technical details

The vulnerability exists in Django REST framework's AdminRenderer, which handles rendering of error responses. When rendering a 400 Bad Request response for an invalid write request, AdminRenderer temporarily overrides the request method to "GET" and directly invokes the view's GET handler (view.get(...)) to retrieve a representation for the error page. Critically, this direct invocation bypasses the normal request processing flow (APIView.dispatch() → APIView.initial() → check_permissions()), allowing the GET handler to execute even when the request's permissions would normally deny GET access. The vulnerability requires: (1) AdminRenderer enabled, (2) client requesting HTML via Accept: text/html header, (3) view permitting write methods (POST/PUT/PATCH/DELETE), (4) GET requests denied by permission class, (5) invalid write request generating 400 response, and (6) GET representation containing sensitive data. The fix involves performing permission checks before executing the simulated GET, avoiding invocation when GET would be denied, or falling back to validation-error-only rendering. Patch available in version 3.17.2.

Affected products

  • Django Software Foundation Django REST framework <= 3.17.1

Timeline

  • 2026-09-01: disclosed
  • 2026-09-01: patched: Fixed in version 3.17.2

References

Related threats