Sign in
Deutsch English Español Polski
High

Django allows unintended model editing

  • Disclosed: 02.12.2019
  • Updated: 11.10.2026 11:20

Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. A Django model admin displaying inline related models, where the user has view-only permissions to a parent model but edit permissions to the inline model, would be presented with an editing UI, allowing POST requests, for updating the inline model. Directly editing the view-only parent model was not possible, but the parent model's save() method was called, triggering potential side effects, and causing pre and post-save signal handlers to be invoked. (To resolve this, the Django admin is adjusted to require edit permissions on the parent model in order for inline models to be editable.)

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Python (PyPI) django >= 2.1, < 2.1.15, >= 2.2, < 2.2.8 2.1.15, 2.2.8

References

CVSS score 6.5/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness (CWE)
CWE-276
Platform
Python (PyPI)
Package
django
Disclosed
02.12.2019
Updated
11.10.2026 11:20

Sources and licenses

OSV / GitHub Advisory Database - PYSEC-2019-15 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-hvmf-r92r-27hr - CC BY 4.0

Vulnerability history: django

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (162) in the archive
Total entries
162
First → latest
10.2007 08.2026
Without a fix
1
Exploited in attacks
0

Severity breakdown

  • Critical 16
  • High 65
  • Medium 63
  • Low 18

Disclosures per year

earlier: 56

Severity:
  1. Django allows unintended model editing this entry
    High · 6.5 CVE-2019-19118 >= 2.1, < 2.1.15, >= 2.2, < 2.2.8 2.1.15, 2.2.8
  2. Django GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsing
    High · 8.8 CVE-2026-15307 < 5.2.17, >= 6.0a1, < 6.0.8 5.2.17, 6.0.8
  3. Django vulnerable to ASGI header spoofing via underscore/hyphen conflation
    High · 7.5 CVE-2026-3902 >= 6.0, < 6.0.4, >= 5.2, < 5.2.13, >= 4.2, < 4.2.30 6.0.4, 5.2.13, 4.2.30
  4. Django: SGI requests with a missing or understated `Content-Length` header could bypass the `DATA_UPLOAD_MAX_MEMORY_SIZE` limit
    High · 7.5 CVE-2026-33034 >= 6.0, < 6.0.4, >= 5.2, < 5.2.13, >= 4.2, < 4.2.30 6.0.4, 5.2.13, 4.2.30
  5. Django vulnerable to Uncontrolled Resource Consumption
    High · 7.5 CVE-2026-25673 >= 6.0, < 6.0.3, >= 5.2, < 5.2.12, >= 4.2, < 4.2.29 6.0.3, 5.2.12, 4.2.29
  6. Django has an SQL Injection issue
    High CVE-2026-1287 >= 6.0a1, < 6.0.2, >= 5.2a1, < 5.2.11, >= 4.2a1, < 4.2.28 6.0.2, 5.2.11, 4.2.28
  7. Django has an SQL Injection issue
    High CVE-2026-1207 >= 6.0a1, < 6.0.2, >= 5.2a1, < 5.2.11, >= 4.2a1, < 4.2.28 6.0.2, 5.2.11, 4.2.28
  8. An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8.
    Critical · 9.1 CVE-2025-64459 >= 4.2, < 4.2.26, >= 5.1, < 5.1.14, >= 5.2, < 5.2.8 4.2.26, 5.1.14, 5.2.8
  9. Django has a denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows
    High · 7.5 CVE-2025-64458 >= 5.2a1, < 5.2.8, >= 5.0a1, < 5.1.14, < 4.2.26 5.2.8, 5.1.14, 4.2.26
  10. Django vulnerable to SQL injection in column aliases
    High · 7.1 CVE-2025-59681 >= 4.2, < 4.2.25, >= 5.1, < 5.1.13, >= 5.2, < 5.2.7 4.2.25, 5.1.13, 5.2.7
  11. Django is subject to SQL injection through its column aliases
    High · 7.1 CVE-2025-57833 < 4.2.24, >= 5.0a1, < 5.1.12, >= 5.2a1, < 5.2.6 4.2.24, 5.1.12, 5.2.6
  12. Django SQL injection in HasKey(lhs, rhs) on Oracle
    High · 9.8 CVE-2024-53908 >= 5.0.0, < 5.0.10, >= 5.1.0, < 5.1.4, >= 4.2.0, < 4.2.17, >= 5.1, < 5.1.4, >= 5.0, < 5.0.10, >= 4.2, < 4.2.17 5.0.10, 5.1.4, 4.2.17
  13. An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values() and values_list() methods on models with a JSONField are subject to SQL injection in column aliases via a cr
    Critical · 9.1 CVE-2024-42005 >= 5.0, < 5.0.8, >= 4.2, < 4.2.15 5.0.8, 4.2.15
  14. Django vulnerable to Denial of Service
    High · 7.5 CVE-2024-39614 >= 5.0, < 5.0.7, >= 4.2, < 4.2.14 5.0.7, 4.2.14
  15. Django Path Traversal vulnerability
    High · 7.5 CVE-2024-39330 >= 5.0, < 5.0.7, >= 4.2, < 4.2.14 5.0.7, 4.2.14
  16. Django vulnerable to Denial of Service
    High · 7.5 CVE-2024-38875 >= 4.2, < 4.2.14, >= 5.0, < 5.0.7 4.2.14, 5.0.7
  17. Django denial-of-service attack in the intcomma template filter
    High · 5.9 CVE-2024-24680 >= 3.2, < 3.2.24, >= 4.2, < 4.2.10, >= 5.0, < 5.0.2 3.2.24, 4.2.10, 5.0.2
  18. In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of s
    High · 5.9 CVE-2023-43665 >= 3.2, < 3.2.22, >= 4.1, < 4.1.12, >= 4.2, < 4.2.6 3.2.22, 4.1.12, 4.2.6
  19. An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is su
    High · 7.5 CVE-2023-46695 >= 3.2, < 3.2.23, >= 4.1, < 4.1.13, >= 4.2, < 4.2.7 3.2.23, 4.1.13, 4.2.7
  20. In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial of service) attack via a very large numb
    High · 7.5 CVE-2023-36053 >= 4.2, < 4.2.3, >= 4.0, < 4.1.10, >= 3.2, < 3.2.20 4.2.3, 4.1.10, 3.2.20
  21. In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been suppor
    Critical · 9.8 CVE-2023-31047 >= 3.2, < 3.2.19, >= 4.0, < 4.1.9, >= 4.2, < 4.2.1 3.2.19, 4.1.9, 4.2.1
Show more (20) Showing 21 of 81

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.