CVE-2026-87975
published 2026-10-06CVE-2026-87975: An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. `django.forms.models.BaseModelFormSet.save_existing_objects()`…
PriorityP423medium4.3CVSS 3.1
AVNACLPRLUINSUCNILAN
EPSS
0.24%
13.9th percentile
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.
`django.forms.models.BaseModelFormSet.save_existing_objects()` used the presence of a primary key on a submitted form's instance as evidence that the instance belonged to the formset's limiting queryset. An object outside that queryset is represented by a newly constructed instance whose primary key can still be populated from submitted data when the model's primary key is a field accepted by the form, such as a `OneToOneField` or parent link used as the primary key of an inline formset's model, or a natural or UUID primary key included in the form's fields. This allows an authenticated user permitted to submit such a formset to delete rows outside the limiting queryset, without any permission on the targeted object, via forged management-form data marking an out-of-queryset object for deletion. Models using the default AutoField primary key are not affected.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.
Django would like to thank Seonggwon Yoon for reporting this issue.
Affected
38 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-24 | controller-rhel8 | — | — |
| ansible-automation-platform-24 | eda-controller-rhel8 | — | — |
| ansible-automation-platform-24 | hub-rhel8 | — | — |
| ansible-automation-platform-24 | lightspeed-rhel8 | — | — |
| ansible-automation-platform-25 | ansible-dev-tools-rhel8 | — | — |
| ansible-automation-platform-25 | controller-rhel8 | — | — |
| ansible-automation-platform-25 | eda-controller-rhel8 | — | — |
| ansible-automation-platform-25 | gateway-rhel8 | — | — |
| ansible-automation-platform-25 | hub-rhel8 | — | — |
| ansible-automation-platform-25 | lightspeed-rhel8 | — | — |
| ansible-automation-platform-26 | ansible-dev-tools-rhel9 | — | — |
| ansible-automation-platform-26 | controller-rhel9 | — | — |
| ansible-automation-platform-26 | eda-controller-rhel9 | — | — |
| ansible-automation-platform-26 | gateway-rhel9 | — | — |
| ansible-automation-platform-26 | hub-rhel9 | — | — |
| ansible-automation-platform-26 | lightspeed-rhel9 | — | — |
| ansible-automation-platform-27 | aap-cloud-billing-rhel9 | — | — |
| ansible-automation-platform-27 | ansible-dev-tools-rhel9 | — | — |
| ansible-automation-platform-27 | controller-rhel9 | — | — |
| ansible-automation-platform-27 | eda-controller-rhel9 | — | — |
| ansible-automation-platform-27 | gateway-rhel9 | — | — |
| ansible-automation-platform-27 | hub-rhel9 | — | — |
| ansible-automation-platform-27 | lightspeed-rhel9 | — | — |
| ansible-automation-platform-27 | metrics-service-rhel9 | — | — |
| ansible-automation-platform-tech-preview | metrics-service-rhel9 | — | — |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
nvdv4.05.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
django: Privilege abuse in model formsets with editable primary keys
vendor_redhat·2026-10-06·CVSS 4.3
CVE-2026-87975 [MEDIUM] CWE-639 django: Privilege abuse in model formsets with editable primary keys
django: Privilege abuse in model formsets with editable primary keys
A flaw was found in Django. When handling model formsets where primary keys can be modified through form fields, the application does not properly validate submitted key values against the authorized query scope. A remote attacker with permission to submit form data can exploit this issue by supplying forged primary key values. This vulnerability allows the attacker to delete database records outside their permitted scope or create new entries through forms intended only for editing existing data.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation
GHSA
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.
ghsa_unreviewed·2026-10-06
CVE-2026-87975 [MEDIUM] CWE-639 An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.
`django.forms.models.BaseModelFormSet.save_existing_objects()` used the presence of a primary key on a submitted form's instance as evidence that the instance belonged to the formset's limiting queryset. An object outside that queryset is represented by a newly constructed instance whose primary key can still be populated from submitted data when the model's primary key is a field accepted by the form, such as a `OneToOneField` or parent link used as the primary key of an inline formset's model, or a natural or UUID primary key included in the form's fields. This allows an authenticated user permitted to submit such a formset to delete rows outside the limiting queryset, without any permission on t
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-87975 python-django4.2: Privilege abuse in model formsets with editable primary keys [epel-all]
bugzilla·2026-10-07·CVSS 4.3
CVE-2026-87975 [MEDIUM] CVE-2026-87975 python-django4.2: Privilege abuse in model formsets with editable primary keys [epel-all]
CVE-2026-87975 python-django4.2: Privilege abuse in model formsets with editable primary keys [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in Django. Model formsets did not correctly validate primary key values submitted in forged POST data when a model's primary key could be set through the form itself, such as with a OneToOneField (or a parent link used as the primary key of an inline formset's model), or a natural or UUID primary key included among the form's fields. An attacker with access to submit data to such a formset could forge POST data referencing primary keys outside the
Bugzilla
CVE-2026-87975 python-django5: Privilege abuse in model formsets with editable primary keys [fedora-all]
bugzilla·2026-10-07·CVSS 4.3
CVE-2026-87975 [MEDIUM] CVE-2026-87975 python-django5: Privilege abuse in model formsets with editable primary keys [fedora-all]
CVE-2026-87975 python-django5: Privilege abuse in model formsets with editable primary keys [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in Django. Model formsets did not correctly validate primary key values submitted in forged POST data when a model's primary key could be set through the form itself, such as with a OneToOneField (or a parent link used as the primary key of an inline formset's model), or a natural or UUID primary key included among the form's fields. An attacker with access to submit data to such a formset could forge POST data referencing primary keys outside the
Bugzilla
CVE-2026-87975 python-django6: Privilege abuse in model formsets with editable primary keys [fedora-all]
bugzilla·2026-10-07·CVSS 4.3
CVE-2026-87975 [MEDIUM] CVE-2026-87975 python-django6: Privilege abuse in model formsets with editable primary keys [fedora-all]
CVE-2026-87975 python-django6: Privilege abuse in model formsets with editable primary keys [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in Django. Model formsets did not correctly validate primary key values submitted in forged POST data when a model's primary key could be set through the form itself, such as with a OneToOneField (or a parent link used as the primary key of an inline formset's model), or a natural or UUID primary key included among the form's fields. An attacker with access to submit data to such a formset could forge POST data referencing primary keys outside the
Bugzilla
CVE-2026-87975 django: Privilege abuse in model formsets with editable primary keys
bugzilla·2026-09-30·CVSS 4.3
CVE-2026-87975 [MEDIUM] CVE-2026-87975 django: Privilege abuse in model formsets with editable primary keys
CVE-2026-87975 django: Privilege abuse in model formsets with editable primary keys
A flaw was found in Django. Model formsets did not correctly validate primary key values submitted in forged POST data when a model's primary key could be set through the form itself, such as with a OneToOneField (or a parent link used as the primary key of an inline formset's model), or a natural or UUID primary key included among the form's fields. An attacker with access to submit data to such a formset could forge POST data referencing primary keys outside the formset's limiting queryset, causing the formset to delete instances outside that queryset, or create instances through what was intended to be an edit-only formset. Models using the default BigAutoField primary key are not affected, since the pr
https://docs.djangoproject.com/en/dev/releases/security/https://github.com/django/django/commit/83cbd21be57483e6b3eb6e4688a561c841aff75ehttps://github.com/django/django/commit/b83ab92bc5474558b083a840ea4628b3261b2cfehttps://github.com/django/django/commit/cce6c57ed30ea83725f9d6abb2fe5ee932bab107https://github.com/django/django/commit/ff27883ca055aa9ab23015b50674a5b10dfe5a41https://groups.google.com/g/django-announcehttps://www.djangoproject.com/weblog/2026/oct/06/security-releases/
2026-10-06
Published