---
id: CVE-2026-114137
title: 'Django REST framework: TokenProxy.delete() reports success and revokes nothing'
summary: >-
  Django REST framework is a toolkit for building Web APIs. From 3.12.0 until
  3.18.2, TokenProxy.delete() in rest_framework/authtoken/models.py uses the
  proxy's user-id pk while the concrete Token token-string primary key
  identifies rows, …
severity: high
cvss: 7.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-390
  - CWE-613
vendor: encode
product: django-rest-framework
affected:
  - 'django-rest-framework >= 3.12.0, < 3.18.2'
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T20:06:57.790Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-114137'
references:
  - url: >-
      https://github.com/encode/django-rest-framework/security/advisories/GHSA-xw6w-gcfp-cf8m
    label: >-
      https://github.com/encode/django-rest-framework/security/advisories/GHSA-xw6w-gcfp-cf8m
  - url: >-
      https://github.com/encode/django-rest-framework/commit/af3fabfd517307fbc5d500fba1ab8f6e25f220b0
    label: >-
      https://github.com/encode/django-rest-framework/commit/af3fabfd517307fbc5d500fba1ab8f6e25f220b0
  - url: 'https://github.com/encode/django-rest-framework/releases/tag/3.18.2'
    label: 'https://github.com/encode/django-rest-framework/releases/tag/3.18.2'
tags:
  - cve.org
ingestedAt: '2026-10-21T21:13:32.893Z'
---

## Overview

Django REST framework is a toolkit for building Web APIs. From 3.12.0 until 3.18.2, TokenProxy.delete() in rest_framework/authtoken/models.py uses the proxy's user-id pk while the concrete Token token-string primary key identifies rows, so Django issues a deletion query that matches no row and reports zero deletions without raising an error. Applications, administrative integrations, or operational scripts that revoke credentials through a TokenProxy instance can therefore believe revocation succeeded while the token remains live and continues authenticating. DRF's own TokenAdmin.delete_model workaround is not affected, but other callers can leave access available indefinitely because DRF tokens do not expire automatically. This issue is fixed in version 3.18.2.

## Affected

- `django-rest-framework >= 3.12.0, < 3.18.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.