The Django project reports the following issue:

""
Django's administrative interface, ``django.contrib.admin``, offers a
feature whereby related objects can be displayed for selection in a
popup window. The mechanism for this relies on placing values in the
URL and querystring which specify the related model to display and the
field through which the relationship is implemented. This mechanism
does perform permission checks at the level of the model class as a
whole.

This mechanism did not, however, verify that the specified field
actually represents a relationship between models. Thus a user with
access to the admin interface, and with sufficient knowledge of model
structure and the appropriate URLs, could constructed popup views
which would display the values of non-relationship fields, including
fields the application developer had not intended to expose in such a
fashion.

To remedy this, the admin interface will now, in addition to its
normal permission checks, verify that the specified field does indeed
represent a relationship, to a model registered with the admin, and
will raise an exception if either condition is not true.
""

This issue is due to be resolved in the upstream 1.4.14, 1.5.9, 1.6.6, and 1.7 release candidate 3 releases.

Acknowledgements:

Red Hat would like to thank the upstream Django project for reporting this issue. Upstream acknowledges Collin Anderson as the original reporter.