In Django REST Framework versions older than 3.17.2, the AdminRenderer calls override_method() to simulate an HTTP GET request when rendering an invalid write request. This triggers view.get() without first running view.check_permissions(), causing the framework to return a 400 Bad Request response that renders sensitive GET data the requester is not allowed to see. The vulnerability is a classic information‑disclosure flaw (CWE‑200) and also represents a misuse of HTTP method handling (CWE‑425).

The affected product is Django REST Framework from encode, specifically any installation running a version earlier than 3.17.2.

The CVSS score of 4.3 indicates medium severity, and an EPSS score of less than 1% suggests a low probability of exploitation. The flaw is not listed in the CISA KEV catalog. An attacker can exploit it by submitting an invalid write request to any API endpoint rendered with the default AdminRenderer, which may surface protected data through the 400 response. The issue does not require elevated privileges, but the data exposed depends on the permissions configured for the view. The flaw also aligns with CWE‑425, involving improper handling of method simulation. The risk is moderate due to the potential data disclosure, but the low exploitation probability mitigates the overall threat.