An admin changelist form that uses ModelAdmin.list_editable incorrectly admits forged POST data, permitting unauthenticated or improperly authorized users to create new model instances. The issue allows the creation of arbitrary objects in the database without the intended permission checks, enabling attackers to insert data that may grant elevated privileges or disrupt application logic.

Django projects running versions 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30 are impacted. Earlier unsupported series, such as 5.0.x, 4.1.x, and 3.2.x, might also be affected.

The CVSS base score is 2.7 and the EPSS score is below 1%, indicating a low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The attack requires access to the Django admin changelist pages and the ability to submit forged POST requests, making it most likely to be leveraged by authenticated staff users or individuals able to craft malicious administrative requests.