CVE-2026-4277 | An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.… | CVSS 9.8 CRITICAL

Description

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Add permissions on inline model instances were not validated on submission of forged `POST` data in `GenericInlineModelAdmin`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank N05ec@LZU-DSLab for reporting this issue.

Metadata

CVE ID: CVE-2026-4277
State: PUBLISHED
Assigner: DSF
Reserved: 2026-03-16 15:26 UTC
Published: 2026-04-07 14:22 UTC
Last updated: 2026-06-23 15:52 UTC
Primary CWE: CWE-862
CWE-862: Missing Authorization
Vendor / Product: djangoproject / Django
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
djangoproject	Django	—	6.0 < 6.0.4, 6.0.4, 5.2 < 5.2.13, 5.2.13 …

Weakness (CWE)

CWE	Source	Description
CWE-862	cna	CWE-862: Missing Authorization

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	adp	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (3)

Django security archive https://docs.djangoproject.com/en/dev/releases/security/
Django releases announcements https://groups.google.com/g/django-announce
Django security releases issued: 6.0.4, 5.2.13, and 4.2.30 https://www.djangoproject.com/weblog/2026/apr/07/security-releases/