Bug 2544152 (CVE-2026-87975)

Summary: CVE-2026-87975 django: Privilege abuse in model formsets with editable primary keys
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: anthomas, brasmith, cmyers, cochase, dnakabaa, dranck, dschmidt, eglynn, ehelms, ggainey, ikhan, jjoyce, jlanda, jmitchel, jpasqual, jpretori, jschluet, juwatts, jwong, kaycoth, kshier, lbrazdil, lcouzens, lhh, mburns, mdellweg, mgarciac, mhulan, mminar, nmoumoul, omaciel, osousa, pcreech, rbiba, rbobbitt, rchan, security-response-team, simaishi, smallamp, sskracic, stcannon, tmalecek, tpfromme, ttakamiy, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Django. When handling model formsets where primary keys can be modified through form fields, the application does not properly validate submitted key values against the authorized query scope. A remote attacker with permission to submit form data can exploit this issue by supplying forged primary key values. This vulnerability allows the attacker to delete database records outside their permitted scope or create new entries through forms intended only for editing existing data.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2547359, 2547358, 2547360    
Bug Blocks:    

Description OSIDB Bzimport 2026-09-30 17:22:23 UTC 
A flaw was found in Django. Model formsets did not correctly validate primary key values submitted in forged POST data when a model's primary key could be set through the form itself, such as with a OneToOneField (or a parent link used as the primary key of an inline formset's model), or a natural or UUID primary key included among the form's fields. An attacker with access to submit data to such a formset could forge POST data referencing primary keys outside the formset's limiting queryset, causing the formset to delete instances outside that queryset, or create instances through what was intended to be an edit-only formset. Models using the default BigAutoField primary key are not affected, since the primary key is not attacker-settable through the form.