CVE-2026-4292lowCWE-862

CVE-2026-4292: falha de baixa gravidade em djangoproject Django

Privilege abuse in ModelAdmin.list_editable

Publicada em

Seguir esta CVE+ Monitorar Django+ Monitorar python-django

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 2.7epss 0.3%
An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Admin changelist forms using `ModelAdmin.list_editable` incorrectly allowed new instances to be created via forged `POST` data. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Cantina for reporting this issue.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
djangoproject · Django
CVEs relacionadas — djangoproject Django

No mesmo produto, das mais perigosas para as menos.

CVE-2025-57833HIGHCVE-2025-57833EPSS 26.1%CVE-2025-64459CRITICALPotential SQL injection via _connector keyword argument in QuerySet and Q objectsEPSS 19.3%CVE-2025-32873MEDIUMCVE-2025-32873EPSS 14.3%CVE-2026-1207MEDIUMPotential SQL injection via raster lookups on PostGISEPSS 12.8%CVE-2025-64460HIGHPotential denial-of-service vulnerability in XML serializer text extractionEPSS 2.2%CVE-2025-64458HIGHPotential denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on WindowsEPSS 1.9%