CVE-2026-4292: Privilege abuse in ModelAdmin.list_editable

Published Apr 7, 2026

Updated

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Admin changelist forms using ModelAdmin.listeditable incorrectly allowed new instances to be created via forged POST data. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Cantina for reporting this issue.

Affected Software

8 affected componentsFixes available

pip/django>=4.2<4.2.30

4.2.30

pip/django>=5.2<5.2.13

5.2.13

pip/django>=6.0<6.0.4

6.0.4

djangoproject Django>=4.2<4.2.30

djangoproject Django>=5.2<5.2.13

djangoproject Django>=6.0<6.0.4

alpine/py3-django<4.2.30-r0

4.2.30-r0

alpine/py3-django<5.2.13-r0

5.2.13-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pip/Django to a version that resolves this vulnerability.
Fixed in 4.2.30
Upgrade
Upgrade pip/Django to a version that resolves this vulnerability.
Fixed in 5.2.13
Upgrade
Upgrade pip/Django to a version that resolves this vulnerability.
Fixed in 6.0.4
Upgrade
Upgrade alpine/py3-django to a version that resolves this vulnerability.
Fixed in 4.2.30-r0
Upgrade
Upgrade alpine/py3-django to a version that resolves this vulnerability.
Fixed in 5.2.13-r0

Event History

Apr 7, 2026

CVE Published

via MITRE·02:22 PM

Data Sourced

via MITRE·02:22 PM

DescriptionWeakness

Data Sourced

via NVD·03:17 PM

RemedyDescriptionSeverityWeaknessAffected Software

Data Sourced

via OSV·03:17 PM

DescriptionSeverityAffected Software

Advisory Published

via GitHub·03:30 PM

Data Sourced

via GitHub·03:30 PM

DescriptionSeverityWeaknessAffected Software

CVE-2026-4292: Privilege abuse in ModelAdmin.list_editable

Affected Software

Remediation

Event History

Company

Resources

Contact