CVE-2026-4292CWE-862

Privilege abuse in ModelAdmin.list_editable

Low · published April 7, 2026

CVSS v3.1
2.7
EPSS
0%
Percentile
28.6
In the wild
Unconfirmed
What it is

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.

Admin changelist forms using `ModelAdmin.list_editable` incorrectly allowed new

instances to be created via forged `POST` data.

Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.

Django would like to thank Cantina for reporting this issue.

The record
Technical detail
CVSS v3.1
2.7 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00360 · 28.6th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-04-07T14:22Z
EPSS history
Timeline
  • 07 APR 14:22Z
    Privilege abuse in ModelAdmin.list_editable
    cvelistv5