CVE-2026-73229: Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests
Django REST framework is a powerful and flexible toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's restframework/renderers.py AdminRenderer.render() uses overridemethod() to simulate GET and directly invokes view.get() without view.checkpermissions() while rendering an invalid write request, allowing a 400 Bad Request HTML response to disclose data from a GET representation that the requester is not permitted to access. This issue is fixed in version 3.17.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
django-rest-frameworkto a version that resolves this vulnerability.Fixed in 3.17.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73229?
The severity of CVE-2026-73229 is medium, rated at 4.3.
What risk does CVE-2026-73229 pose?
CVE-2026-73229 has a risk rating of 22.
How do I fix CVE-2026-73229?
To fix CVE-2026-73229, upgrade to Django REST framework version 3.17.2 or later.
What type of vulnerability is CVE-2026-73229?
CVE-2026-73229 is classified as an information leak vulnerability.
What systems are affected by CVE-2026-73229?
CVE-2026-73229 affects versions of Django REST framework prior to 3.17.2.