diff options
| author | Jacob Walls <jacobtylerwalls@gmail.com> | 2026-03-16 18:05:22 -0400 |
|---|---|---|
| committer | Jacob Walls <jacobtylerwalls@gmail.com> | 2026-04-07 07:33:08 -0400 |
| commit | 397c22048244db2cd4bb78f570e6c72a3967bf36 (patch) | |
| tree | e84f0cf74cabf13c9755c41f339c043f63f29805 /docs/releases/5.2.13.txt | |
| parent | 60ffa957c427e10a2eb0fc80d1674a8a8ccc30b0 (diff) | |
[5.2.x] Fixed CVE-2026-4292 -- Disallowed instance creation via ModelAdmin.list_editable.
Thanks Natalia Bidart, Jake Howard, and Markus Holtermann for reviews.
Backport of 6afe7ce93964f56e33a29d477c269436f9b60cbf from main.
Diffstat (limited to 'docs/releases/5.2.13.txt')
| -rw-r--r-- | docs/releases/5.2.13.txt | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/docs/releases/5.2.13.txt b/docs/releases/5.2.13.txt index 8b03103508..8b303f2700 100644 --- a/docs/releases/5.2.13.txt +++ b/docs/releases/5.2.13.txt @@ -36,3 +36,13 @@ forged ``POST`` data in This issue has severity "low" according to the :ref:`Django security policy <security-disclosure>`. + +CVE-2026-4292: Privilege abuse in ``ModelAdmin.list_editable`` +============================================================== + +Admin changelist forms using +:attr:`~django.contrib.admin.ModelAdmin.list_editable` incorrectly allowed new +instances to be created via forged ``POST`` data. + +This issue has severity "low" according to the :ref:`Django security policy +<security-disclosure>`. |