by Kastro
Paper/Archive/CVE-2026-4277

CVE-2026-4277

djangoproject Django — Privilege abuse in GenericInlineModelAdmin

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
37
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 39.8.398 × 208.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Add permissions on inline model instances were not validated on submission of forged `POST` data in `GenericInlineModelAdmin`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank N05ec@LZU-DSLab for reporting this issue.

Affected

ProductAffectedFixed inSource
Django6.0 – < 6.0.46.0.4CNA
Django5.2 – < 5.2.135.2.13CNA
Django4.2 – < 4.2.304.2.30CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorydocs.djangoproject.com/en/dev/releases/securityrefgroups.google.com/g/django-announceadvisorydjangoproject.com/weblog/2026/apr/07/security-releases