CVE-2016-2048: Django ModelAdmin Object Creation Bypass
Summary
CVE-2016-2048: Django 1.9.x before 1.9.2, when ModelAdmin.save_as is set to True, allows remote authenticated users to bypass intended access restrictions and create ModelAdmin objects via the "Save as New" option when editing objects... Affects django versions >= 1.9, < 1.9.2. Fixed in 1.9.2. How to fix ↓
Also tracked for
- python-django · Debian:11
The same CVE-2016-2048 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework that provides a set of tools and libraries for building web applications. It follows the model-view-controller architectural pattern and emphasizes reusability and rapid development. Django includes a feature called ModelAdmin, which allows developers to manage database records through an administrative interface. This vulnerability affects Django versions 1.9.x before 1.9.2. The ModelAdmin.save_as option, when set to True, can be exploited by remote authenticated users to bypass access restrictions and create ModelAdmin objects. This vulnerability can lead to unauthorized creation of objects and potential misuse of the administrative interface.
Vulnerability Detail
The vulnerability (CVE-2016-2048) in Django arises from a flaw in the handling of the "Save as New" option in the ModelAdmin interface. When the save_as option is enabled, authenticated users with the change permission can create new ModelAdmin objects by copying existing ones. This bypasses the intended access restrictions and allows the creation of objects that should not be permitted. An attacker with the change permission can abuse this vulnerability to create unauthorized objects and potentially gain elevated privileges within the application. It is important to note that this vulnerability only affects Django versions 1.9.x before 1.9.2.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.9.2
This is the first release that contains the fix.
pip install --upgrade "django==1.9.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading Django is not immediately feasible, a temporary workaround is to disable the ModelAdmin.save_as option by setting it to False in the corresponding ModelAdmin class. This can be done by modifying the admin.py file in your Django project. Here's an example:
from django.contrib import admin
from myapp.models import MyModel
@admin.register(MyModel)
class MyModelAdmin(admin.ModelAdmin):
save_as = False
By explicitly setting save_as to False, the "Save as New" option will be disabled for the affected ModelAdmin class.
Conclusion
The CVE-2016-2048 vulnerability in Django allows authenticated users to bypass access restrictions and create unauthorized objects using the ModelAdmin interface. To mitigate this vulnerability, it is recommended to upgrade Django to version 1.9.2 or later and ensure that the ModelAdmin.save_as option is set to False. If immediate upgrade is not possible, disabling the save_as option in the affected ModelAdmin class can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django →
FAQ
This vulnerability allows authenticated users to bypass access restrictions and create unauthorized objects using the ModelAdmin interface in Django. It can lead to potential misuse of the administrative interface and unauthorized access to sensitive data.
This vulnerability affects Django versions 1.9.x before 1.9.2. If you are using an affected version of Django and have enabled the ModelAdmin.save_as option, your application may be vulnerable.
While specific exploits targeting this vulnerability may not be publicly available, it is important to promptly apply the recommended fix or workaround to mitigate the risk of unauthorized object creation.
No, this vulnerability requires authentication. Remote attackers without valid credentials cannot exploit this vulnerability.
Yes, this vulnerability is identified as CVE-2016-2048.
Related vulnerabilities
Recent vulnerabilities recorded for django.
