# CVE-2026-87975: python-django: An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18

CVE-2026-87975 is fixed in 6 products on 1 platform, first by DEBIAN-CVE-2026-87975, released October 20, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-87975
- Priority: Routine
- CVSS: n/a (moderate)
- EPSS: 0.0023
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Oct 6, 2026

## Description

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. `django.forms.models.BaseModelFormSet.save_existing_objects()` used the presence of a primary key on a submitted form's instance as evidence that the instance belonged to the formset's limiting queryset. An object outside that queryset is represented by a newly constructed instance whose primary key can still be populated from submitted data when the model's primary key is a field accepted by the form, such as a `OneToOneField` or parent link used as the primary key of an inline formset's model, or a natural or UUID primary key included in the form's fields. This allows an authenticated user permitted to submit such a formset to delete rows outside the limiting queryset, without any permission on the targeted object, via forged management-form data marking an out-of-queryset object for deletion. Models using the default AutoField primary key are not affected. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Seonggwon Yoon for reporting this issue.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | python-Django opensuse-leap 16.0 | 5.2.4-bp160.12.1 | [OPENSUSE-SU-2026:22196-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-22196-1.md) | Nov 7, 2026 |
| Linux | python-Django sles 15.7 | 4.2.11-150600.3.68.1 | [SUSE-SU-2026:4626-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4626-1.md) | Nov 7, 2026 |
| Linux | python-django Debian 12.15 (bookworm) | 3:3.2.25-0+deb12u6 | [DEBIAN-CVE-2026-87975](https://patchblox.com/security/data/fix/linux/debian-cve-2026-87975.md) | Oct 20, 2026 |
| Linux | python-django5 Fedora 43 | 5.2.18-1.fc43 | [FEDORA-2026-A7B8FF851A](https://patchblox.com/security/data/fix/linux/fedora-2026-a7b8ff851a.md) | Nov 7, 2026 |
| Linux | python3-django Fedora 43 | 5.2.18-1.fc43 | [FEDORA-2026-A7B8FF851A](https://patchblox.com/security/data/fix/linux/fedora-2026-a7b8ff851a.md) | Nov 7, 2026 |
| Linux | python3-django-bash-completion Fedora 43 | 5.2.18-1.fc43 | [FEDORA-2026-A7B8FF851A](https://patchblox.com/security/data/fix/linux/fedora-2026-a7b8ff851a.md) | Nov 7, 2026 |
| Linux | python3-django-doc Fedora 43 | 5.2.18-1.fc43 | [FEDORA-2026-A7B8FF851A](https://patchblox.com/security/data/fix/linux/fedora-2026-a7b8ff851a.md) | Nov 7, 2026 |

---

Data as of 2026-11-09T07:25:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.