CVE-2026-4292: 
Django vulnerability analysis and mitigation

CVE-2026-4292 is an authorization bypass vulnerability in Django's admin changelist forms that allows authenticated admin users to create unauthorized model instances via forged POST data. It affects Django 4.2 before 4.2.30, 5.2 before 5.2.13, and 6.0 before 6.0.4; earlier unsupported series (5.0.x, 4.1.x, 3.2.x) were not evaluated but may also be affected. The vulnerability was reported by Cantina and disclosed on April 7, 2026. It carries a CVSS v3.1 base score of 2.7 (Low) (GitHub Advisory, Django Blog).

The root cause is a missing authorization check (CWE-862) combined with external control of assumed-immutable web parameters (CWE-472) in Django's admin changelist view. When ModelAdmin.list_editable is configured, the admin changelist form is intended only to allow editing of existing model instances; however, the form processing logic failed to prevent forged POST data from triggering the creation of entirely new model instances. An attacker with admin-level access (high privileges required) can craft a malicious POST request to the admin changelist endpoint to instantiate new database records that bypass normal creation workflows and authorization controls (GitHub Advisory, Django Blog).

Successful exploitation allows an authenticated admin user to create unauthorized database records by submitting forged POST requests to Django admin changelist forms with list_editable enabled, bypassing normal administrative approval and creation controls. The primary impact is on data integrity — unauthorized model instances can be inserted into the database without proper authorization. There is no confidentiality or availability impact, and the scope is limited to the affected Django application's database (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires high privileges (admin-level authentication), significantly limiting the attacker pool. The EPSS score is approximately 0.014% (3rd percentile), indicating a very low probability of exploitation in the near term. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Identify target: Locate a Django application running a vulnerable version (4.2 < 4.2.30, 5.2 < 5.2.13, or 6.0 < 6.0.4) with the Django admin interface exposed and at least one ModelAdmin class configured with list_editable.
2. Authenticate as admin: Obtain valid Django admin credentials (e.g., through credential theft, phishing, or reuse of compromised credentials).
3. Navigate to changelist: Access the admin changelist page for a model that has list_editable fields configured (e.g., /admin/appname/modelname/).
4. Forge POST data: Craft a malicious POST request to the changelist URL that includes form fields for a new model instance rather than an existing one — specifically, omitting or manipulating the object ID fields that would normally identify an existing record for editing.
5. Submit forged request: Send the crafted POST request (e.g., using a browser developer tool, curl, or Burp Suite) to the changelist endpoint, causing Django to process the data as a new object creation rather than an edit.
6. Verify unauthorized record creation: Confirm that a new model instance has been created in the database without going through the standard add view authorization checks (GitHub Advisory, Django Blog).

• Logs: Django admin access logs showing POST requests to changelist URLs (e.g., /admin/<app>/<model>/) that result in new object creation rather than updates; unexpected entries in Django's LogEntry table (admin audit log) showing ADDITION actions originating from the changelist view rather than the standard add view (/admin/<app>/<model>/add/).
• Database: Unexpected new records in model tables that lack a corresponding admin LogEntry with the standard add-view path, or records created at unusual times inconsistent with normal admin activity.
• Network: Unusual POST requests to admin changelist endpoints with form data that includes fields not normally submitted by the standard changelist form (e.g., missing _selected_action or containing new-object form fields).

Django has released patched versions addressing this vulnerability: 4.2.30, 5.2.13, and 6.0.4. Organizations should upgrade to the appropriate patched version immediately. As a temporary workaround, administrators can disable list_editable in all ModelAdmin configurations if the feature is not critical to operations. Organizations running unsupported Django series (5.0.x, 4.1.x, 3.2.x) should prioritize upgrading to a supported and patched version, as those series were not evaluated but may also be affected (Django Blog, GitHub Advisory).

The Django Software Foundation credited Cantina with responsibly reporting the issue and published a security advisory alongside the patched releases on April 7, 2026. The vulnerability was disclosed via the django-announce mailing list and the oss-security mailing list. Downstream Linux distributions including Ubuntu (USN-8154-1, USN-8154-2), openSUSE, SUSE, Fedora, and Mageia have all issued updated packages. IBM also published an advisory noting that IBM Storage Defender - Resiliency Service is affected (Django Blog, IBM Advisory).