CVE-2026-4292: Django Privilege Abuse in ModelAdmin.list_editable
Summary
CVE-2026-4292: Django vulnerable to privilege abuse in ModelAdmin.list_editable. Affects django across 3 version ranges.
>= 4.2, < 4.2.30
>= 5.2, < 5.2.13
>= 6.0, < 6.0.4
Fixed in 4.2.30, 5.2.13 or 6.0.4, depending on the release line you run. How to fix ↓
Also tracked for
- django · Bitnami
The same CVE-2026-4292 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It is widely used for building web applications and provides a robust administrative interface through its ModelAdmin feature. However, certain versions of Django are vulnerable to a privilege abuse issue that affects the security of admin changelist forms.
Vulnerability Detail
An issue was discovered in Django versions 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. The vulnerability arises from the improper handling of ModelAdmin.list_editable, which allows unauthorized users to create new instances through forged POST data. This could lead to privilege escalation, where users gain access to functionalities they should not have, potentially compromising the integrity of the application.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 4.2, < 4.2.304.2.30pip install --upgrade "django==4.2.30" -
>= 5.2, < 5.2.135.2.13pip install --upgrade "django==5.2.13" -
>= 6.0, < 6.0.46.0.4pip install --upgrade "django==6.0.4"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can restrict access to the admin interface or implement additional validation checks on the server-side to prevent unauthorized creation of instances until you can apply the patch.
Conclusion
The privilege abuse vulnerability in Django's ModelAdmin.list_editable poses a risk to applications using affected versions. It is crucial to update to the latest patched versions to safeguard against potential exploitation. Additionally, utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for django →
FAQ
Django versions 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30 are affected. Unsupported versions like 5.0.x, 4.1.x, and 3.2.x may also be impacted.
The CVSS score of this vulnerability is 2.7, indicating a low severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
If exploited, this vulnerability could allow unauthorized users to create new instances in the admin interface, leading to privilege escalation and potential data integrity issues.
Yes, you can restrict access to the admin interface or implement server-side validation checks to prevent unauthorized instance creation until the patch is applied.
Related vulnerabilities
Recent vulnerabilities recorded for django.
