Django up to 4.2.29/5.2.12/6.0.3 GenericInlineModelAdmin authorization

Summaryinfo

A vulnerability, which was classified as critical, has been found in Django up to 4.2.29/5.2.12/6.0.3. Affected is an unknown function. This manipulation of the argument GenericInlineModelAdmin causes authorization. This vulnerability appears as CVE-2026-4277. The attack may be initiated remotely. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Django up to 4.2.29/5.2.12/6.0.3 and classified as critical. Affected by this vulnerability is an unknown functionality. The manipulation of the argument GenericInlineModelAdmin with an unknown input leads to a authorization vulnerability. The CWE definition for the vulnerability is CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. The impact remains unknown. The summary by CVE is:

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Add permissions on inline model instances were not validated on submission of forged `POST` data in `GenericInlineModelAdmin`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank N05ec@LZU-DSLab for reporting this issue.

It is possible to read the advisory at docs.djangoproject.com. This vulnerability is known as CVE-2026-4277 since 03/16/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 05/11/2026).

The vulnerability scanner Nessus provides a plugin with the ID 313665 (SUSE SLES15 Security Update : python-Django (SUSE-SU-2026:1740-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 4.2.30, 5.2.13 or 6.0.4 eliminates this vulnerability. The upgrade is hosted for download at docs.djangoproject.com.

The vulnerability is also documented in the databases at Tenable (313665) and CERT Bund (WID-SEC-2026-1002). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• Ubuntu Linux
• Open Source Django

Productinfo

Type

• Content Management System

Name

• Django

Version

• 4.2.0
• 4.2.1
• 4.2.2
• 4.2.3
• 4.2.4
• 4.2.5
• 4.2.6
• 4.2.7
• 4.2.8
• 4.2.9
• 4.2.10
• 4.2.11
• 4.2.12
• 4.2.13
• 4.2.14
• 4.2.15
• 4.2.16
• 4.2.17
• 4.2.18
• 4.2.19
• 4.2.20
• 4.2.21
• 4.2.22
• 4.2.23
• 4.2.24
• 4.2.25
• 4.2.26
• 4.2.27
• 4.2.28
• 4.2.29
• 5.2.0
• 5.2.1
• 5.2.2
• 5.2.3
• 5.2.4
• 5.2.5
• 5.2.6
• 5.2.7
• 5.2.8
• 5.2.9
• 5.2.10
• 5.2.11
• 5.2.12
• 6.0.0
• 6.0.1
• 6.0.2
• 6.0.3

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion