CVE-2026-4292
An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.
Published Apr 7, 2026 · updated Jun 17, 2026 · djangoproject django
An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Admin changelist forms using incorrectly allowed new instances to be created via forged data. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Cantina for reporting this issue.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Apr 7, 2026 · NIST NVD
Detected
An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Admin changelist forms using incorrectly allowed new instances to be created via forged data. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Cantina for reporting this issue.
Jun 17, 2026 · NIST NVD
Updated
An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Admin changelist forms using incorrectly allowed new instances to be created via forged data. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Cantina for reporting this issue.
Affected
- cpe djangoproject/djangoversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-4292
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-4292
An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Admin changelist forms using incorrectly allowed new instances to be created via forged data. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.
nvd.nist.gov