{"id":"CVE-2026-4277","title":"An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.\nAdd permissions on inline model instances were not validated on submission of\r\nforged `POST` data in `GenericInlineModelAdmin`.\nEarlier, unsupported D…","summary":"An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.\nAdd permissions on inline model instances were not validated on submission of\r\nforged `POST` data in `GenericInlineModelAdmin`.\nEarlier, unsupported D…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-862"],"vendor":"djangoproject","product":"django","affected":["django >= 4.2, < 4.2.30","django >= 5.2, < 5.2.13","django >= 6.0, < 6.0.4"],"patched":["django 6.0.4"],"published":"2026-04-07","updated":"2026-06-17","sourceUpdated":"2026-06-17T10:56:20.810","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-4277","references":[{"url":"https://docs.djangoproject.com/en/dev/releases/security/","label":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"},{"url":"https://groups.google.com/g/django-announce","label":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"},{"url":"https://www.djangoproject.com/weblog/2026/apr/07/security-releases/","label":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-04-09T18:09:56.739026Z"},"ingestedAt":"2026-09-13T06:03:15.368Z","epss":0.00458,"epssPercentile":0.38927,"slug":"CVE-2026-4277","body":"## Overview\n\nAn issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.\nAdd permissions on inline model instances were not validated on submission of\r\nforged `POST` data in `GenericInlineModelAdmin`.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank N05ec@LZU-DSLab for reporting this issue.\n\n## Affected\n\n- `django >= 4.2, < 4.2.30`\n- `django >= 5.2, < 5.2.13`\n- `django >= 6.0, < 6.0.4`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `django 6.0.4`","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}