The vulnerability occurs when a malicious actor submits forged POST data to Django’s GenericInlineModelAdmin, allowing the manipulation of permissions on inline model instances without proper validation. This lack of authorization checks means an attacker who can reach the admin interface could grant themselves additional privileges or modify data they are not permitted to access, leading to potential compromise of data integrity and confidentiality.

Affected versions include Django 4.2 prior to 4.2.30, Django 5.2 prior to 5.2.13, and Django 6.0 prior to 6.0.4. Earlier unsupported series such as 5.0.x, 4.1.x, and 3.2.x may also be vulnerable.

The issue carries a CVSS score of 9.8, indicating a critical severity, yet the EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, reflecting a low likelihood of widespread exploitation at present. Nevertheless, attackers who can reach the Django admin pages and submit forged POST requests can exploit this flaw; the adversary would need to send crafted data that bypasses the normal permission checks, which could lead to unauthorized privilege escalation and data tampering.