... ne , the reference server for ASGI. This issue has severity "low" according to the Django security policy . CVE-2026-4277: Privilege abuse in GenericInlineModelAdmin ¶ Add permissions on inline model instances were not validated on submission of forged PO ... T data in GenericInlineModelAdmin . This issue has severity "low" according to the Django security policy . CVE-2026-4292: Privilege abuse in ModelAdmin.list_editable ¶ Admin changelist forms using list_editable incorrectly allowed new instances to be cre ... icy . 目次 Django 5.2.13 release notes CVE-2026-3902: ASGI header spoofing via underscore/hyphen conflation CVE-2026-4277: Privilege abuse in GenericInlineModelAdmin CVE-2026-4292: Privilege abuse in ModelAdmin.list_editable CVE-2026-33033: Potential deni ... ... : Privilege escalation in the Django admin. ¶ Since Django 2.1, a Django model admin displaying a parent model with related model inli ... , but would trigger the parent model's save() method, and cause pre and post-save signal handlers to be invoked. This is a privilege escalation as a user who lacks permission to edit a model should not be able to trigger its save-related signals. To resol ... his change was necessary: that it is not currently feasible to maintain the existing behavior while escaping the potential privilege escalation in a way that would avoid a recurrence of similar issues in the future, and that would be compatible with Djang ... ... ne , the reference server for ASGI. This issue has severity "low" according to the Django security policy . CVE-2026-4277: Privilege abuse in GenericInlineModelAdmin ¶ Add permissions on inline model instances were not validated on submission of forged PO ... T data in GenericInlineModelAdmin . This issue has severity "low" according to the Django security policy . CVE-2026-4292: Privilege abuse in ModelAdmin.list_editable ¶ Admin changelist forms using list_editable incorrectly allowed new instances to be cre ... icy . 目次 Django 4.2.30 release notes CVE-2026-3902: ASGI header spoofing via underscore/hyphen conflation CVE-2026-4277: Privilege abuse in GenericInlineModelAdmin CVE-2026-4292: Privilege abuse in ModelAdmin.list_editable CVE-2026-33033: Potential deni ... ... 2019-19118: Privilege escalation in the Django admin. ¶ Since Django 2.1, a Django model admin displaying a parent model with related model inli ... , but would trigger the parent model's save() method, and cause pre and post-save signal handlers to be invoked. This is a privilege escalation as a user who lacks permission to edit a model should not be able to trigger its save-related signals. To resol ... his change was necessary: that it is not currently feasible to maintain the existing behavior while escaping the potential privilege escalation in a way that would avoid a recurrence of similar issues in the future, and that would be compatible with Djang ... ... ne , the reference server for ASGI. This issue has severity "low" according to the Django security policy . CVE-2026-4277: Privilege abuse in GenericInlineModelAdmin ¶ Add permissions on inline model instances were not validated on submission of forged PO ... T data in GenericInlineModelAdmin . This issue has severity "low" according to the Django security policy . CVE-2026-4292: Privilege abuse in ModelAdmin.list_editable ¶ Admin changelist forms using list_editable incorrectly allowed new instances to be cre ... 973 ). 目次 Django 6.0.4 release notes CVE-2026-3902: ASGI header spoofing via underscore/hyphen conflation CVE-2026-4277: Privilege abuse in GenericInlineModelAdmin CVE-2026-4292: Privilege abuse in ModelAdmin.list_editable CVE-2026-33033: Potential deni ... ... ne , the reference server for ASGI. This issue has severity "low" according to the Django security policy . CVE-2026-4277: Privilege abuse in GenericInlineModelAdmin ¶ Add permissions on inline model instances were not validated on submission of forged PO ... T data in GenericInlineModelAdmin . This issue has severity "low" according to the Django security policy . CVE-2026-4292: Privilege abuse in ModelAdmin.list_editable ¶ Admin changelist forms using list_editable incorrectly allowed new instances to be cre ... icy . 目次 Django 4.2.30 release notes CVE-2026-3902: ASGI header spoofing via underscore/hyphen conflation CVE-2026-4277: Privilege abuse in GenericInlineModelAdmin CVE-2026-4292: Privilege abuse in ModelAdmin.list_editable CVE-2026-33033: Potential deni ... ... ne , the reference server for ASGI. This issue has severity "low" according to the Django security policy . CVE-2026-4277: Privilege abuse in GenericInlineModelAdmin ¶ Add permissions on inline model instances were not validated on submission of forged PO ... T data in GenericInlineModelAdmin . This issue has severity "low" according to the Django security policy . CVE-2026-4292: Privilege abuse in ModelAdmin.list_editable ¶ Admin changelist forms using list_editable incorrectly allowed new instances to be cre ... icy . 目次 Django 5.2.13 release notes CVE-2026-3902: ASGI header spoofing via underscore/hyphen conflation CVE-2026-4277: Privilege abuse in GenericInlineModelAdmin CVE-2026-4292: Privilege abuse in ModelAdmin.list_editable CVE-2026-33033: Potential deni ... ... : Privilege escalation in the Django admin. ¶ Since Django 2.1, a Django model admin displaying a parent model with related model inli ... , but would trigger the parent model's save() method, and cause pre and post-save signal handlers to be invoked. This is a privilege escalation as a user who lacks permission to edit a model should not be able to trigger its save-related signals. To resol ... his change was necessary: that it is not currently feasible to maintain the existing behavior while escaping the potential privilege escalation in a way that would avoid a recurrence of similar issues in the future, and that would be compatible with Djang ... ... 2019-19118: Privilege escalation in the Django admin. ¶ Since Django 2.1, a Django model admin displaying a parent model with related model inli ... , but would trigger the parent model's save() method, and cause pre and post-save signal handlers to be invoked. This is a privilege escalation as a user who lacks permission to edit a model should not be able to trigger its save-related signals. To resol ... his change was necessary: that it is not currently feasible to maintain the existing behavior while escaping the potential privilege escalation in a way that would avoid a recurrence of similar issues in the future, and that would be compatible with Djang ... ... ne , the reference server for ASGI. This issue has severity "low" according to the Django security policy . CVE-2026-4277: Privilege abuse in GenericInlineModelAdmin ¶ Add permissions on inline model instances were not validated on submission of forged PO ... T data in GenericInlineModelAdmin . This issue has severity "low" according to the Django security policy . CVE-2026-4292: Privilege abuse in ModelAdmin.list_editable ¶ Admin changelist forms using list_editable incorrectly allowed new instances to be cre ... 973 ). 目次 Django 6.0.4 release notes CVE-2026-3902: ASGI header spoofing via underscore/hyphen conflation CVE-2026-4277: Privilege abuse in GenericInlineModelAdmin CVE-2026-4292: Privilege abuse in ModelAdmin.list_editable CVE-2026-33033: Potential deni ... 2026年10月08日