Django security archiveVendor advisory
https://docs.djangoproject.com/en/dev/releases/security CVE-2026-4277
Privilege abuse in GenericInlineModelAdmin
Description
An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Add permissions on inline model instances were not validated on submission of forged `POST` data in `GenericInlineModelAdmin`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank N05ec@LZU-DSLab for reporting this issue.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableYes
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 9, 2026 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
Default status: unaffected | CVE List | 6.0 to < 6.0.4 | affected |
| 6.0.4 | unaffected | ||
| 5.2 to < 5.2.13 | affected | ||
| 5.2.13 | unaffected | ||
| 4.2 to < 4.2.30 | affected | ||
| 4.2.30 | unaffected | ||
DjangoBrowse PyPI / Django | GitHub Advisory | 6.0 to < 6.0.4 · Fixed in 6.0.4 | affected |
| 5.2 to < 5.2.13 · Fixed in 5.2.13 | affected | ||
| 4.2 to < 4.2.30 · Fixed in 4.2.30 | affected |
References
6github.com
https://github.com/django/django github.com
https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-52.yaml Django releases announcementsmailing list
https://groups.google.com/g/django-announce nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-4277 Django security releases issued: 6.0.4, 5.2.13, and 4.2.30Vendor advisory
https://www.djangoproject.com/weblog/2026/apr/07/security-releases