Django REST Framework Data Exposure via Improper Permission Check
CVE-2026-73229

4.3MEDIUM

Key Information:

Vendor

Encode

Status
Django-rest-framework
Vendor
CVE Published:
11 August 2026

What is CVE-2026-73229?

The Django REST Framework prior to version 3.17.2 is susceptible to a data exposure vulnerability due to an improper permission check in the AdminRenderer. Specifically, the implementation allows an invalid write request to bypass the necessary view.check_permissions() call, leading to unauthorized access to sensitive data originally protected under the GET representation. This flaw results in a 400 Bad Request response that inadvertently exposes information, thereby increasing the risk of data leaks. The issue was addressed in version 3.17.2.

Affected Version(s)

django-rest-framework < 3.17.2

References

https://github.com/encode/django-rest-framework/security/...
x_refsource_CONFIRM
https://github.com/encode/django-rest-framework/pull/10012
x_refsource_MISC
https://github.com/encode/django-rest-framework/commit/71...
x_refsource_MISC

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.