{
  "cveId": "CVE-2026-4277",
  "url": "https://patchblox.com/security/cve/CVE-2026-4277",
  "summary": "CVE-2026-4277 is fixed in 4 products on 1 platform, first by DEBIAN-CVE-2026-4277, released April 7, 2026. It is not reported as exploited. Patch Radar priority: Urgent.",
  "title": "python-django: An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30",
  "description": "An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Add permissions on inline model instances were not validated on submission of\r forged \u0060POST\u0060 data in \u0060GenericInlineModelAdmin\u0060. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank N05ec@LZU-DSLab for reporting this issue.",
  "published": "2026-04-07T07:00:00Z",
  "severity": "critical",
  "cvss": 9.8,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00466,
  "epssPercentile": 0.40598,
  "priority": "Urgent",
  "priorityTier": 2,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "python-Django",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "5.2.4-bp160.7.1",
      "fix": "OPENSUSE-SU-2026:20578-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-20578-1",
      "released": "2026-04-13T13:39:10Z"
    },
    {
      "platform": "linux",
      "product": "python-django",
      "release": "Debian 14",
      "fixedVersion": "3:4.2.30-1",
      "fix": "DEBIAN-CVE-2026-4277",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-4277",
      "released": "2026-04-07T15:17:46Z"
    },
    {
      "platform": "linux",
      "product": "python-django",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "1:1.11.11-1ubuntu1.21\u002Besm15",
      "fix": "python-django 1:1.11.11-1ubuntu1.21\u002Besm15",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-python-django-1-1.11.11-1ubuntu1.21-esm15",
      "released": "2026-04-15T18:59:20Z"
    },
    {
      "platform": "linux",
      "product": "python-django-common",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "1:1.11.11-1ubuntu1.21\u002Besm15",
      "fix": "python-django-common 1:1.11.11-1ubuntu1.21\u002Besm15",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-python-django-common-1-1.11.11-1ubuntu1.21-esm15",
      "released": "2026-04-15T18:59:20Z"
    },
    {
      "platform": "linux",
      "product": "python3-django",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "1:1.11.11-1ubuntu1.21\u002Besm15",
      "fix": "python3-django 1:1.11.11-1ubuntu1.21\u002Besm15",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-python3-django-1-1.11.11-1ubuntu1.21-esm15",
      "released": "2026-04-15T18:59:20Z"
    },
    {
      "platform": "linux",
      "product": "python3-django",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "2:2.2.12-1ubuntu0.29\u002Besm8",
      "fix": "python3-django 2:2.2.12-1ubuntu0.29\u002Besm8",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-python3-django-2-2.2.12-1ubuntu0.29-esm8",
      "released": "2026-04-15T18:59:24Z"
    },
    {
      "platform": "linux",
      "product": "python3-django",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "2:3.2.12-2ubuntu1.26",
      "fix": "python3-django 2:3.2.12-2ubuntu1.26",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-python3-django-2-3.2.12-2ubuntu1.26",
      "released": "2026-04-15T18:59:27Z"
    },
    {
      "platform": "linux",
      "product": "python3-django",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "3:4.2.11-1ubuntu1.15",
      "fix": "python3-django 3:4.2.11-1ubuntu1.15",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-python3-django-3-4.2.11-1ubuntu1.15",
      "released": "2026-04-15T18:59:29Z"
    },
    {
      "platform": "linux",
      "product": "python3-django",
      "release": "Ubuntu 25.10 (questing)",
      "fixedVersion": "3:5.2.4-1ubuntu2.4",
      "fix": "python3-django 3:5.2.4-1ubuntu2.4",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-questing-python3-django-3-5.2.4-1ubuntu2.4",
      "released": "2026-04-15T18:59:31Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}