In Django 6.1 prior to 6.1.3 and 6.0 prior to 6.0.10 the admin utility display_for_field() failed to obfuscate password fields for custom user models that are not the default AUTH_USER_MODEL or for subclasses that inherited the password field via multi‑table inheritance. Staff users with only view permission on such models can read full password hashes in the read‑only change form. The leaked hashes can be used for offline brute‑force or credential stuffing attacks, compromising account confidentiality; the vulnerability does not allow code execution or privilege escalation.

The defect impacts Django releases 6.1 before 6.1.3 and 6.0 before 6.0.10, and potentially earlier unsupported series such as 5.1.x, 5.0.x, and 4.2.x. It manifests when custom user models or subclasses of AUTH_USER_MODEL are exposed in the admin with view‑only permissions.

The CVSS score of 2.1 indicates a very low severity. Exploitation requires legitimate staff access to the admin interface; external attackers cannot trigger the path. The disclosed information consists solely of password hashes, reducing the immediacy of impact but enabling offline cracking. EPSS data is unavailable and the vulnerability is not in the CISA KEV catalog, suggesting no known public exploitation but still warranting remediation due to the sensitive data revealed.