CVE-2007-0405: Django Improper Access Control Vulnerability
Summary
CVE-2007-0405: Django Improper Access Control. Affects django versions >= 0.95, < 1.0. Fixed in 1.0. How to fix ↓
Also tracked for
- python-django · Debian:11
The same CVE-2007-0405 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It provides a robust set of features for building web applications, including an authentication system, URL routing, and an ORM for database interaction. However, versions prior to 1.0 are susceptible to a vulnerability in the AuthenticationMiddleware, specifically in the LazyUser class, which fails to properly cache user names across requests.
Vulnerability Detail
The vulnerability arises from the LazyUser class in Django's AuthenticationMiddleware, which does not adequately cache the user name across requests. This flaw allows remote authenticated users to impersonate other users, gaining unauthorized access to their privileges. The implications of this vulnerability can lead to data breaches, unauthorized actions, and a significant compromise of user privacy and security.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0
This is the first release that contains the fix.
pip install --upgrade "django==1.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement additional checks in your application to verify user permissions before granting access to sensitive actions. However, this is not a substitute for upgrading to a secure version of Django.
Conclusion
In summary, CVE-2007-0405 is a critical vulnerability in Django's AuthenticationMiddleware that allows authenticated users to impersonate others due to improper caching of user names. It is crucial to upgrade to version 1.0 or later to mitigate this risk.
See every vulnerability recorded for django →
FAQ
Django versions prior to 1.0 are affected by this vulnerability.
The vulnerability can allow authenticated users to gain unauthorized access to other users' privileges, leading to data breaches and unauthorized actions.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
While the best solution is to upgrade, you can implement additional permission checks as a temporary workaround.
More information can be found in the advisory database at https://github.com/pypa/advisory-database/blob/main/vulns/django/PYSEC-2026-629.yaml.
References
Related vulnerabilities
Recent vulnerabilities recorded for django.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
