CVE-2026-4292

OVERVIEW CVE-2026-4292 is a privilege escalation vulnerability affecting Django's admin interface, specifically the list_editable feature in ModelAdmin. The flaw allows authenticated administrators to create new instances through forged POST data when list_editable is enabled. Affected versions include Django 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30, with potentially vulnerable unsupported series including 5.0.x, 4.1.x, and 3.2.x. SEVERITY The vulnerability carries a CVSS score of 2.7 (LOW) with a network-accessible attack vector requiring high-level privileges and no user interaction. The impact is limited to integrity concerns with no confidentiality or availability effects. The FAUCET Risk Score of 34.0/100 suggests moderate organizational concern, though the EPSS score of 0.0001 indicates minimal prevalence relative to other disclosed vulnerabilities. EXPLOITATION STATUS There is no evidence of active exploitation, with the vulnerability not appearing on the KEV catalog or Hot List. The attack requires valid admin credentials, significantly limiting real-world attack surface. Community attention remains low, and no public exploit code has been identified, suggesting this remains primarily a theoretical concern for organizations with compromised or malicious administrator accounts.