Password Exposure in Django Admin for Specific User Models
CVE-2026-113733

2.1LOW

Key Information:

Vendor

Djangoproject

Status
Django
Vendor
CVE Published:
3 November 2026

What is CVE-2026-113733?

A vulnerability in the Django framework allows authenticated staff users with only view permission on certain user models to access full password hashes through the read-only change form. This issue arises when the django.contrib.admin.utils.display_for_field() function fails to obfuscate passwords for user models that do not strictly adhere to the AUTH_USER_MODEL or inherit through multi-table inheritance. As a result, versions prior to 6.1.3 and 6.0.10, alongside older unsupported versions, may pose risks for sensitive data exposure.

Affected Version(s)

Django 6.1 < 6.1.3

Django 6.0 < 6.0.10

Django 6.1.3

References

https://docs.djangoproject.com/en/dev/releases/security/
vendor-advisory
https://groups.google.com/g/django-announce
mailing-list
https://github.com/django/django/commit/f5b039a619b3b5394...
patch

CVSS V4

Score:
2.1
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Aaron chen
Jake Howard
Natalia Bidart
Natalia Bidart
Jake Howard
Jacob Walls
.