# CVE-2026-87975: Django authorization bypass in BaseModelFormSet deletion

Source: https://junglewise.ai/threats/cve-2026-87975-an-issue-was-discovered-in-django-6-1-before-6-1-2-6-0-before-6-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-06. Updated: 2026-10-06  
License: CC BY 4.0 with a link back

CVE-2026-87975 · Severity: medium · CVSS 4.3 · Published 2026-10-06

Django is a widely-used web application framework for Python. An authentication bypass flaw in its form handling allows authenticated users to delete database records outside the permission scope they should have access to by submitting specially crafted form data. This could enable unauthorized data destruction without explicit permission on target records.

Technologies: [Django Software Foundation Django](https://junglewise.ai/threats/technologies/django-software-foundation-django). Vendors: [Django Software Foundation](https://junglewise.ai/threats/vendors/django-software-foundation).

## Quick answers

**Is CVE-2026-87975 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-87975 being exploited in the wild.

**How severe is CVE-2026-87975?** Medium severity, with a CVSS score of 4.3, published 6 October 2026.

**Which products and versions are affected?** Django Software Foundation Django 6.1 before 6.1.2, 6.0 before 6.0.9, 5.2 before 5.2.18; unsupported series 5.1.x, 5.0.x, and 4.2.x may also be affected.

**Is there a fix for CVE-2026-87975?** Yes: fixed in Django 6.1.2, 6.0.9, 5.2.18. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-87975 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-87975?** Check whether you run Django Software Foundation Django at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Django 6.1.2, 6.0.9, 5.2.18

## Technical details

The vulnerability exists in django.forms.models.BaseModelFormSet.save_existing_objects(), which improperly validates object ownership by trusting the presence of a primary key on form instances. When a model uses a primary key field accepted by the form (such as OneToOneField, parent link, natural key, or UUID primary key), an attacker can forge management-form data to mark out-of-queryset objects for deletion. Models using the default AutoField are not affected. The flaw requires authentication and form submission capability but no explicit permission on the targeted object.

## Affected products

- Django Software Foundation Django 6.1 before 6.1.2, 6.0 before 6.0.9, 5.2 before 5.2.18; unsupported series 5.1.x, 5.0.x, and 4.2.x may also be affected

## Timeline

- 2026-10-06: disclosed

## References

- [https://pypi.org/project/Django/](https://pypi.org/project/Django/)
- [https://docs.djangoproject.com/en/dev/releases/security/](https://docs.djangoproject.com/en/dev/releases/security/)

## Related threats

- [Django GIS spatial reference string injection](https://junglewise.ai/threats/cve-2026-114582-an-issue-was-discovered-in-django-6-1-before-6-1-3-6-0-before-6)
- [Django SSRF in GeoJSON coordinate reference systems](https://junglewise.ai/threats/cve-2026-111362-an-issue-was-discovered-in-django-6-1-before-6-1-3-6-0-before-6)
- [Django log injection in BaseGeometryWidget.deserialize()](https://junglewise.ai/threats/cve-2026-111211-an-issue-was-discovered-in-django-6-1-before-6-1-3-6-0-before-6)
- [Django multipart parser excessive memory consumption via base64 Content-Transfer-Encoding](https://junglewise.ai/threats/cve-2026-108147-an-issue-was-discovered-in-django-6-1-before-6-1-3-6-0-4-before)
- [Django spatial lookups SSRF via crafted VRT document](https://junglewise.ai/threats/cve-2026-87890-an-issue-was-discovered-in-django-6-1-before-6-1-2-6-0-before-6-0)