---
id: CVE-2007-0405
aliases:
  - GHSA-mwv2-398h-v489
  - PYSEC-2026-629
title: Django Improper Access Control
summary: Django Improper Access Control
severity: medium
vendor: django
product: django
ecosystem: pip
affected:
  - 'django >= 0.95, < 1.0'
patched:
  - django 1.0
published: '2022-05-01'
updated: '2026-07-06'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-mwv2-398h-v489'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2007-0405'
  - url: 'https://github.com/django/django/commit/3c5782287e'
  - url: >-
      https://github.com/django/django/commit/e89f0a65581f82a5740bfe989136cea75d09cd67
  - url: 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31628'
  - url: 'https://github.com/django/django'
  - url: 'http://code.djangoproject.com/changeset/3754'
tags:
  - osv
  - pip
epss: 0.01259
epssPercentile: 0.67798
ingestedAt: '2026-07-08T18:25:51.459Z'
---

## Overview

The LazyUser class in the AuthenticationMiddleware for Django 0.95 does not properly cache the user name across requests, which allows remote authenticated users to gain the privileges of a different user.

## Affected packages

- `django >= 0.95, < 1.0`

## Remediation

Upgrade to a patched release:

- `django 1.0`