Bug 2564007 (CVE-2026-113733)

Summary:	CVE-2026-113733 django: Password hash disclosure to "view only" admin users with custom user models
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	anthomas, brasmith, cmyers, cochase, dnakabaa, dranck, dschmidt, eglynn, ehelms, ggainey, jjoyce, jlanda, jmitchel, jpasqual, jpretori, jschluet, juwatts, jwong, kaycoth, kshier, lblicha, lbrazdil, lcouzens, lhh, mburns, mdellweg, mgarciac, mhulan, mminar, nmoumoul, ogajduse, omaciel, osousa, pcreech, rbiba, rbobbitt, rchan, security-response-team, simaishi, smallamp, sskracic, stcannon, tguha, tmalecek, tpfromme, ttakamiy, yguenane, zhunting
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Django. Administrative users granted view-only permissions to user accounts may be exposed to full password hashes when viewing specific custom user models. In certain configurations involving custom or inherited user account structures, the administrative interface improperly displays the complete password hash instead of masking or withholding it. This information disclosure allows users with read-only administrative access to retrieve sensitive credential hashes, potentially enabling offline password-cracking attacks.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Deadline:	2026-11-03

Description OSIDB Bzimport 2026-10-30 13:27:38 UTC

CVE-2026-113733: Password hash disclosure to &quot;view only&quot; admin users with custom user models

Admin users with the view (but not change) permission to a user model were

displayed the entire password hash when the model was not `AUTH_USER_MODEL`,
or when `AUTH_USER_MODEL` inherited its `password` field from a concrete
parent model through multi-table inheritance.

Thanks to Aaron chen for the report.

This issue has severity "low" according to the [Django Security Policy](https://docs.djangoproject.com/en/dev/internals/security/#security-issue-severity-levels).