UBUNTU-CVE-2026-113733: Medium severity ubuntu/python-django vulnerability
Published Nov 3, 2026
·Updated
[Password hash disclosure to "view only" admin users with custom user models]
Affected Software
8 affected components
ubuntu/python-django*
ubuntu/python-django*
ubuntu/python-django*
ubuntu/python-django*
ubuntu/python-django*
ubuntu/python-django*
ubuntu/python-django*
ubuntu/python-django*
Event History
Nov 3, 2026
CVE Published
via OSV·12:00 AM
Data Sourced
via OSV·12:00 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Which deployments should be prioritized for review?
Prioritize Django deployments that use a custom user model and grant any users view-only access to the administrative interface. The issue is specifically described as exposing password hashes in that scenario.
2
What access would an attacker need?
The described exposure involves a view-only admin user, so an attacker would need access to an account with that level of administrative access. The provided information does not describe an unauthenticated exploitation path.
3
Can affected or fixed package versions be identified from this advisory data?
No. The provided data names Ubuntu's python-django package but does not include affected versions, fixed versions, or a temporary mitigation.