Fixed #27416 -- Prevented ModelFormSet from creating objects for invalid PKs in data.

1 files changed, 6 insertions, 5 deletions

diff --git a/django/forms/models.py b/django/forms/models.py
index 3d74225434..a0f3ff53b3 100644
--- a/django/forms/models.py
+++ b/django/forms/models.py
@@ -755,12 +755,13 @@ class BaseModelFormSet(BaseFormSet):
         forms_to_delete = self.deleted_forms
         for form in self.initial_forms:
             obj = form.instance
+            # If the pk is None, it means either:
+            # 1. The object is an unexpected empty model, created by invalid
+            #    POST data such as an object outside the formset's queryset.
+            # 2. The object was already deleted from the database.
+            if obj.pk is None:
+                continue
             if form in forms_to_delete:
-                # If the pk is None, it means that the object can't be
-                # deleted again. Possible reason for this is that the
-                # object was already deleted from the DB. Refs #14877.
-                if obj.pk is None:
-                    continue
                 self.deleted_objects.append(obj)
                 self.delete_existing(obj, commit=commit)
             elif form.has_changed():