{
  "cveId": "CVE-2026-4292",
  "url": "https://patchblox.com/security/cve/CVE-2026-4292",
  "summary": "CVE-2026-4292 is fixed in 4 products on 1 platform, first by DEBIAN-CVE-2026-4292, released April 7, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "python-django: An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30",
  "description": "An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Admin changelist forms using \u0060ModelAdmin.list_editable\u0060 incorrectly allowed new\r instances to be created via forged \u0060POST\u0060 data. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Cantina for reporting this issue.",
  "published": "2026-04-07T07:00:00Z",
  "severity": "low",
  "cvss": 2.7,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
  "epss": 0.00305,
  "epssPercentile": 0.23434,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "python-Django",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "5.2.4-bp160.7.1",
      "fix": "OPENSUSE-SU-2026:20578-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-20578-1",
      "released": "2026-04-13T13:39:10Z"
    },
    {
      "platform": "linux",
      "product": "python-django",
      "release": "Debian 14",
      "fixedVersion": "3:4.2.30-1",
      "fix": "DEBIAN-CVE-2026-4292",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-4292",
      "released": "2026-04-07T15:17:46Z"
    },
    {
      "platform": "linux",
      "product": "python-django",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "1:1.11.11-1ubuntu1.21\u002Besm15",
      "fix": "python-django 1:1.11.11-1ubuntu1.21\u002Besm15",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-python-django-1-1.11.11-1ubuntu1.21-esm15",
      "released": "2026-04-15T18:59:20Z"
    },
    {
      "platform": "linux",
      "product": "python-django-common",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "1:1.11.11-1ubuntu1.21\u002Besm15",
      "fix": "python-django-common 1:1.11.11-1ubuntu1.21\u002Besm15",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-python-django-common-1-1.11.11-1ubuntu1.21-esm15",
      "released": "2026-04-15T18:59:20Z"
    },
    {
      "platform": "linux",
      "product": "python3-django",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "1:1.11.11-1ubuntu1.21\u002Besm15",
      "fix": "python3-django 1:1.11.11-1ubuntu1.21\u002Besm15",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-python3-django-1-1.11.11-1ubuntu1.21-esm15",
      "released": "2026-04-15T18:59:20Z"
    },
    {
      "platform": "linux",
      "product": "python3-django",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "2:2.2.12-1ubuntu0.29\u002Besm8",
      "fix": "python3-django 2:2.2.12-1ubuntu0.29\u002Besm8",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-python3-django-2-2.2.12-1ubuntu0.29-esm8",
      "released": "2026-04-15T18:59:24Z"
    },
    {
      "platform": "linux",
      "product": "python3-django",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "2:3.2.12-2ubuntu1.26",
      "fix": "python3-django 2:3.2.12-2ubuntu1.26",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-python3-django-2-3.2.12-2ubuntu1.26",
      "released": "2026-04-15T18:59:27Z"
    },
    {
      "platform": "linux",
      "product": "python3-django",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "3:4.2.11-1ubuntu1.15",
      "fix": "python3-django 3:4.2.11-1ubuntu1.15",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-python3-django-3-4.2.11-1ubuntu1.15",
      "released": "2026-04-15T18:59:29Z"
    },
    {
      "platform": "linux",
      "product": "python3-django",
      "release": "Ubuntu 25.10 (questing)",
      "fixedVersion": "3:5.2.4-1ubuntu2.4",
      "fix": "python3-django 3:5.2.4-1ubuntu2.4",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-questing-python3-django-3-5.2.4-1ubuntu2.4",
      "released": "2026-04-15T18:59:31Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}