CVE-2026-4277: Privilege abuse in GenericInlineModelAdmin

Published Apr 7, 2026

Updated

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Add permissions on inline model instances were not validated on submission of forged POST data in GenericInlineModelAdmin. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank N05ec@LZU-DSLab for reporting this issue.

Affected Software

8 affected componentsFixes available

pip/django>=4.2<4.2.30

4.2.30

pip/django>=5.2<5.2.13

5.2.13

pip/django>=6.0<6.0.4

6.0.4

djangoproject Django>=4.2<4.2.30

djangoproject Django>=5.2<5.2.13

djangoproject Django>=6.0<6.0.4

alpine/py3-django<4.2.30-r0

4.2.30-r0

alpine/py3-django<5.2.13-r0

5.2.13-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pip/Django to a version that resolves this vulnerability.
Fixed in 4.2.30
Upgrade
Upgrade pip/Django to a version that resolves this vulnerability.
Fixed in 5.2.13
Upgrade
Upgrade pip/Django to a version that resolves this vulnerability.
Fixed in 6.0.4
Upgrade
Upgrade alpine/py3-django to a version that resolves this vulnerability.
Fixed in 4.2.30-r0
Upgrade
Upgrade alpine/py3-django to a version that resolves this vulnerability.
Fixed in 5.2.13-r0

Event History

Apr 7, 2026

CVE Published

via MITRE·02:22 PM

Data Sourced

via MITRE·02:22 PM

DescriptionWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Data Sourced

via OSV·03:17 PM

DescriptionSeverityAffected Software

Advisory Published

via GitHub·03:30 PM

Data Sourced

via GitHub·03:30 PM

DescriptionWeaknessAffected Software

Oct 26, 2026

Data Sourced

via NVD·09:10 PM

RemedyAffected Software

CVE-2026-4277: Privilege abuse in GenericInlineModelAdmin

Affected Software

Remediation

Event History

Company

Resources

Contact