Django security archiveVendor advisory
https://docs.djangoproject.com/en/dev/releases/security CVE-2026-4292
LOW
Privilege abuse in ModelAdmin.list_editable
Record summary
CVE-2026-4292 has a selected CVSS score of 2.7 (low).
Description
An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Admin changelist forms using `ModelAdmin.list_editable` incorrectly allowed new instances to be created via forged `POST` data. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Cantina for reporting this issue.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 7, 2026 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
Default status: unaffected | CVE List | 6.0 to < 6.0.4 | affected |
| 6.0.4 | unaffected | ||
| 5.2 to < 5.2.13 | affected | ||
| 5.2.13 | unaffected | ||
| 4.2 to < 4.2.30 | affected | ||
| 4.2.30 | unaffected | ||
DjangoBrowse PyPI / Django | GitHub Advisory | 6.0 to < 6.0.4 · Fixed in 6.0.4 | affected |
| 5.2 to < 5.2.13 · Fixed in 5.2.13 | affected | ||
| 4.2 to < 4.2.30 · Fixed in 4.2.30 | affected |
References
6github.com
https://github.com/django/django github.com
https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-53.yaml Django releases announcementsmailing list
https://groups.google.com/g/django-announce nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-4292 Django security releases issued: 6.0.4, 5.2.13, and 4.2.30Vendor advisory
https://www.djangoproject.com/weblog/2026/apr/07/security-releases