Read the docs
TI-2026-84392 Aliases CVE-2026-113733GHSA-p5cm-h6hp-4g48

Password hash disclosure to view-only admin users in Django

Priority LOW 11CWE-522Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-522.

Summary

Django from 6.1 before 6.1.3 and from 6.0 before 6.0.10 is affected. The admin's display_for_field() function did not hide the password field of user models other than AUTH_USER_MODEL, or of such a model inheriting its password field through multi-table inheritance. This is a case of insufficiently protected credentials (CWE-522). An authenticated staff user with only view permission on such a model can obtain full password hashes through the read-only change form.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

An issue was discovered in Django 6.1 before 6.1.3 and 6.0 before 6.0.10. The `django.contrib.admin.utils.display_for_field()` function did not obfuscate the password field of user models other than `AUTH_USER_MODEL`, or of an `AUTH_USER_MODEL` inheriting its password field from a concrete parent model through multi-table inheritance, which allows authenticated staff users with only the view permission on such a model to obtain full password hashes via the read-only change form. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Aaron chen for reporting this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00392 33rd percentileScored 2026-11-07
Fix Fixed Django (djangoproject): 6.1.3, 6.0.10

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
djangoprojectDjango6.1 to before 6.1.3; 6.0 to before 6.0.106.1.3, 6.0.10Patch availableCNA
  • Django Vendordjangoproject Affected 6.1 to before 6.1.3; 6.0 to before 6.0.10 Fixed in 6.1.3, 6.0.10 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*——djangoproject
  • cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* Versions — — ·djangoproject

Remediation

Django 6.1 users should upgrade to 6.1.3 and Django 6.0 users should upgrade to 6.0.10.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

  • Fix · CNA Django (djangoproject) Fixed in 6.1.3, 6.0.10

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    djangoproject Django — Django security releases issued: 6.1.3, 6.0.10, and 5.2.19

    6 records Highest priority Priority LOW 6 LOW

    Other records, highest priority first

    • TI-2026-84393 Server-side request forgery in Django via SpatialReference string inputPriority LOW 37
    • TI-2026-84390 Server-side request forgery via crs member of GeoJSON geometriesPriority LOW 37
    • TI-2026-84388 Memory exhaustion in Django MultiPartParser via base64 file uploadsPriority LOW 37
    Show all 6 records → Advisory →

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-113733
  2. 2026-11-03 CISA SSVC decision points changed
  3. 2026-11-03 Alias added: GHSA-p5cm-h6hp-4g48

References

Patch 3

Advisory 2

Other 1

  • TI-2022-15177 An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. CVSS 3.1CRITICAL 9.8
  • TI-2020-05994 Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection… CVSS 3.1CRITICAL 9.8
  • TI-2023-10198 An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0… CVSS 3.1HIGH 7.5
  • TI-2019-14306 Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. CVSS 3.1CRITICAL 9.8
  • TI-2019-10595 An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x… CVSS 3.0CRITICAL 9.8
  • TI-2021-14006 Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection… CVSS 3.1CRITICAL 9.8
See all 171 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences