CVE-2026-4292

Privilege abuse in ModelAdmin.list_editable

Published Apr 7, 2026 CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed

Description

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.
Admin changelist forms using `ModelAdmin.list_editable` incorrectly allowed new
instances to be created via forged `POST` data.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Cantina for reporting this issue.

Analysis

Technical impact

An admin changelist form that uses ModelAdmin.list_editable incorrectly admits forged POST data, permitting unauthenticated or improperly authorized users to create new model instances. The issue allows the creation of arbitrary objects in the database without the intended permission checks, enabling attackers to insert data that may grant elevated privileges or disrupt application logic.

Affected Systems

Django projects running versions 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30 are impacted. Earlier unsupported series, such as 5.0.x, 4.1.x, and 3.2.x, might also be affected.

Risk and Exploitability

The CVSS base score is 2.7 and the EPSS score is below 1%, indicating a low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The attack requires access to the Django admin changelist pages and the ability to submit forged POST requests, making it most likely to be leveraged by authenticated staff users or individuals able to craft malicious administrative requests.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

djangoproject

Django

unaffected

Version	Status	Constraints
`6.0`	affected	< 6.0.4
`6.0.4`	unaffected	—
`5.2`	affected	< 5.2.13
`5.2.13`	unaffected	—
`4.2`	affected	< 4.2.30
`4.2.30`	unaffected	—

Configuration 1 [-]

OR	cpe:2.3:a:djangoproject:django::::::::
	cpe:2.3:a:djangoproject:django::::::::
	cpe:2.3:a:djangoproject:django::::::::

No data.

Vendor Product Versions

Djangoproject

Django

Version	Status	Scheme	Platform
`[6.0,6.0.4)`	affected	semver	—
`6.0.4`	unaffected	semver	—
`[5.2,5.2.13)`	affected	semver	—
`5.2.13`	unaffected	semver	—
`[4.2,4.2.30)`	affected	semver	—
`4.2.30`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to Django 6.0.4 or later, 5.2.13 or later, or 4.2.30 or later.
If an upgrade is not immediately possible, restrict or disable the use of ModelAdmin.list_editable in the admin interface.
Ensure that only users with the appropriate permissions can access admin changelist forms.
Monitor incoming admin POST requests for unexpected object creation attempts.

Generated by OpenCVE AI on April 13, 2026 at 18:25 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-mmwr-2jhp-mc7j	Django vulnerable to privilege abuse in ModelAdmin.list_editable
Ubuntu USN	USN-8154-1	Django vulnerabilities
Ubuntu USN	USN-8154-2	Django vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.305% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://docs.djangoproject.com/en/dev/releases/security/
https://groups.google.com/g/django-announce
https://nvd.nist.gov/vuln/detail/CVE-2026-4292
https://www.cve.org/CVERecord?id=CVE-2026-4292
https://www.djangoproject.com/weblog/2026/apr/07/security-releases/

History

Apr 13, 2026 5:45 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:djangoproject:django::::::::

Apr 8, 2026 8:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Djangoproject Djangoproject django
Vendors & Products		Djangoproject Djangoproject django

Apr 8, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-472
References		https://nvd.nist.gov/vuln/detail/CVE-2026-4292 https://www.cve.org/CVERecord?id=CVE-2026-4292
Metrics	threat_severity `None`	threat_severity `Moderate`

Apr 7, 2026 6:00 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 2.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 7, 2026 3:15 PM Description updated. Title updated. Weaknesses updated. Added references View changes

Type	Values Removed	Values Added
Description		An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Admin changelist forms using `ModelAdmin.list_editable` incorrectly allowed new instances to be created via forged `POST` data. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Cantina for reporting this issue.
Title		Privilege abuse in ModelAdmin.list_editable
Weaknesses		CWE-862
References		https://docs.djangoproject.com/en/dev/releases/security/ https://groups.google.com/g/django-announce https://www.djangoproject.com/weblog/2026/apr/07/security-releases/