James Bennett of Django reports:
Django's bundled administrative interface keeps a log of actions taken, preserving the history of any object which is exposed through the admin interface. This history view does not perform any permission checks beyond confirming that the user has access to the administrative interface; as such, any user with admin access can view the history of any object accessible in the admin interface, and see summaries of each change made to an object.
To remedy this, the admin history view for an object will now perform the same permission checks as other admin views for the same object.
External reference:
https://www.djangoproject.com/weblog/2013/feb/19/security/