Django Software Foundation up to 5.2.17/6.0.8/6.1.1 Formset django/forms/models.py permission

Summaryinfo

A vulnerability was found in Django Software Foundation Django up to 5.2.17/6.0.8/6.1.1. It has been classified as problematic. This affects the function django.forms.models.BaseModelFormSet.save_existing_objects of the file django/forms/models.py of the component Formset. Performing a manipulation results in permission. This vulnerability is cataloged as CVE-2026-87975. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as problematic has been found in Django Software Foundation Django up to 5.2.17/6.0.8/6.1.1. This affects the function django.forms.models.BaseModelFormSet.save_existing_objects of the file django/forms/models.py of the component Formset. The manipulation with an unknown input leads to a permission vulnerability. CWE is classifying the issue as CWE-275. This is going to have an impact on integrity. The summary by CVE is:

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. `django.forms.models.BaseModelFormSet.save_existing_objects()` used the presence of a primary key on a submitted form's instance as evidence that the instance belonged to the formset's limiting queryset. An object outside that queryset is represented by a newly constructed instance whose primary key can still be populated from submitted data when the model's primary key is a field accepted by the form, such as a `OneToOneField` or parent link used as the primary key of an inline formset's model, or a natural or UUID primary key included in the form's fields. This allows an authenticated user permitted to submit such a formset to delete rows outside the limiting queryset, without any permission on the targeted object, via forged management-form data marking an out-of-queryset object for deletion. Models using the default AutoField primary key are not affected. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Seonggwon Yoon for reporting this issue.

It is possible to read the advisory at docs.djangoproject.com. This vulnerability is uniquely identified as CVE-2026-87975 since 09/09/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/06/2026). The attack technique deployed by this issue is T1222 according to MITRE ATT&CK.

Upgrading to version 5.2.18, 6.0.9 or 6.1.2 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Content Management System

Vendor

• Django Software Foundation

Name

• Django

Version

• 5.2.0
• 5.2.1
• 5.2.2
• 5.2.3
• 5.2.4
• 5.2.5
• 5.2.6
• 5.2.7
• 5.2.8
• 5.2.9
• 5.2.10
• 5.2.11
• 5.2.12
• 5.2.13
• 5.2.14
• 5.2.15
• 5.2.16
• 5.2.17
• 6.0.0
• 6.0.1
• 6.0.2
• 6.0.3
• 6.0.4
• 6.0.5
• 6.0.6
• 6.0.7
• 6.0.8
• 6.1.0
• 6.1.1

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion