CVE-2026-4292: Privilege abuse in ModelAdmin.list_editable
Published Apr 7, 2026
·Updated
An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Admin changelist forms using `ModelAdmin.list_editable` incorrectly allowed new instances to be created via forged `POST` data. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Cantina for reporting this issue.
Affected Software
6 affected componentsFixes available
pip/Django>=4.2<4.2.30
4.2.30
pip/Django>=5.2<5.2.13
5.2.13
pip/Django>=6.0<6.0.4
6.0.4
djangoproject Django>=4.2<4.2.30
djangoproject Django>=5.2<5.2.13
djangoproject Django>=6.0<6.0.4
Remediation
Patch Available
Event History
Apr 7, 2026
CVE Published
via MITRE·02:22 PM
Data Sourced
via MITRE·02:22 PM
DescriptionWeakness
Data Sourced
via NVD·03:17 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:17 PM
RemedyAffected Software
Advisory Published
via GitHub·03:30 PM
Data Sourced
via GitHub·03:30 PM
DescriptionSeverityWeaknessAffected Software