CVE-2026-73229

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-73229", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-11T14:41:20.122Z", "datePublished": "2026-08-11T18:59:34.151Z", "dateUpdated": "2026-08-11T20:06:33.042Z"}, "containers": {"cna": {"title": "Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests", "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "lang": "en", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/encode/django-rest-framework/security/advisories/GHSA-g47c-3xmw-q6m2", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/encode/django-rest-framework/security/advisories/GHSA-g47c-3xmw-q6m2"}, {"name": "https://github.com/encode/django-rest-framework/pull/10012", "tags": ["x_refsource_MISC"], "url": "https://github.com/encode/django-rest-framework/pull/10012"}, {"name": "https://github.com/encode/django-rest-framework/commit/71f81946906e52f9dc8e5d22a0f3d2afa50c455e", "tags": ["x_refsource_MISC"], "url": "https://github.com/encode/django-rest-framework/commit/71f81946906e52f9dc8e5d22a0f3d2afa50c455e"}, {"name": "https://github.com/encode/django-rest-framework/commit/9e82afc98acfe6fc28c9bf78147f0c5b3f222cb5", "tags": ["x_refsource_MISC"], "url": "https://github.com/encode/django-rest-framework/commit/9e82afc98acfe6fc28c9bf78147f0c5b3f222cb5"}, {"name": "https://github.com/encode/django-rest-framework/releases/tag/3.17.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/encode/django-rest-framework/releases/tag/3.17.2"}], "affected": [{"vendor": "encode", "product": "django-rest-framework", "versions": [{"version": "< 3.17.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-11T18:59:34.151Z"}, "descriptions": [{"lang": "en", "value": "Django REST framework is a powerful and flexible toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's rest_framework/renderers.py AdminRenderer.render() uses override_method() to simulate GET and directly invokes view.get() without view.check_permissions() while rendering an invalid write request, allowing a 400 Bad Request HTML response to disclose data from a GET representation that the requester is not permitted to access. This issue is fixed in version 3.17.2."}], "source": {"advisory": "GHSA-g47c-3xmw-q6m2", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/encode/django-rest-framework/security/advisories/GHSA-g47c-3xmw-q6m2", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-11T20:06:10.552931Z", "id": "CVE-2026-73229", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-11T20:06:33.042Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-73229", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-11T20:06:10.552931Z"}}}], "references": [{"url": "https://github.com/encode/django-rest-framework/security/advisories/GHSA-g47c-3xmw-q6m2", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-11T20:06:28.595Z"}}], "cna": {"title": "Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests", "source": {"advisory": "GHSA-g47c-3xmw-q6m2", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "encode", "product": "django-rest-framework", "versions": [{"status": "affected", "version": "< 3.17.2"}]}], "references": [{"url": "https://github.com/encode/django-rest-framework/security/advisories/GHSA-g47c-3xmw-q6m2", "name": "https://github.com/encode/django-rest-framework/security/advisories/GHSA-g47c-3xmw-q6m2", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/encode/django-rest-framework/pull/10012", "name": "https://github.com/encode/django-rest-framework/pull/10012", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/encode/django-rest-framework/commit/71f81946906e52f9dc8e5d22a0f3d2afa50c455e", "name": "https://github.com/encode/django-rest-framework/commit/71f81946906e52f9dc8e5d22a0f3d2afa50c455e", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/encode/django-rest-framework/commit/9e82afc98acfe6fc28c9bf78147f0c5b3f222cb5", "name": "https://github.com/encode/django-rest-framework/commit/9e82afc98acfe6fc28c9bf78147f0c5b3f222cb5", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/encode/django-rest-framework/releases/tag/3.17.2", "name": "https://github.com/encode/django-rest-framework/releases/tag/3.17.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Django REST framework is a powerful and flexible toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's rest_framework/renderers.py AdminRenderer.render() uses override_method() to simulate GET and directly invokes view.get() without view.check_permissions() while rendering an invalid write request, allowing a 400 Bad Request HTML response to disclose data from a GET representation that the requester is not permitted to access. This issue is fixed in version 3.17.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-11T18:59:34.151Z"}}}, "cveMetadata": {"cveId": "CVE-2026-73229", "state": "PUBLISHED", "dateUpdated": "2026-08-11T20:06:33.042Z", "dateReserved": "2026-08-11T14:41:20.122Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-11T18:59:34.151Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "django-rest-framework", "vendor": "encode", "versions": [{"status": "affected", "version": "< 3.17.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Django REST framework is a powerful and flexible toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's rest_framework/renderers.py AdminRenderer.render() uses override_method() to simulate GET and directly invokes view.get() without view.check_permissions() while rendering an invalid write request, allowing a 400 Bad Request HTML response to disclose data from a GET representation that the requester is not permitted to access. This issue is fixed in version 3.17.2."}, {"lang": "es", "value": "Django REST framework es un conjunto de herramientas potente y flexible para construir APIs web. Antes de la versi\u00f3n 3.17.2, AdminRenderer.render() de rest_framework/renderers.py de Django REST Framework usa override_method() para simular GET e invoca directamente view.get() sin view.check_permissions() mientras renderiza una solicitud de escritura no v\u00e1lida, permitiendo que una respuesta HTML 400 Bad Request divulgue datos de una representaci\u00f3n GET a la que el solicitante no tiene permiso para acceder. Este problema est\u00e1 solucionado en la versi\u00f3n 3.17.2."}], "id": "CVE-2026-73229", "lastModified": "2026-10-24T15:10:00.190", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73229", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-11T20:06:10.552931Z", "version": "2.0.3"}}]}, "published": "2026-08-11T20:18:48.113", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/encode/django-rest-framework/commit/71f81946906e52f9dc8e5d22a0f3d2afa50c455e"}, {"source": "security-advisories@github.com", "url": "https://github.com/encode/django-rest-framework/commit/9e82afc98acfe6fc28c9bf78147f0c5b3f222cb5"}, {"source": "security-advisories@github.com", "url": "https://github.com/encode/django-rest-framework/pull/10012"}, {"source": "security-advisories@github.com", "url": "https://github.com/encode/django-rest-framework/releases/tag/3.17.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/encode/django-rest-framework/security/advisories/GHSA-g47c-3xmw-q6m2"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/encode/django-rest-framework/security/advisories/GHSA-g47c-3xmw-q6m2"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{"bugzilla": {"description": "djangorestframework: Django REST framework: Information disclosure via improper permission checks in AdminRenderer", "id": "2514325", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514325"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-425", "details": ["Django REST framework is a powerful and flexible toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's rest_framework/renderers.py AdminRenderer.render() uses override_method() to simulate GET and directly invokes view.get() without view.check_permissions() while rendering an invalid write request, allowing a 400 Bad Request HTML response to disclose data from a GET representation that the requester is not permitted to access. This issue is fixed in version 3.17.2.", "A flaw was found in Django REST framework. The AdminRenderer component, when processing an invalid write request, can improperly invoke a GET request without adequate permission checks. This oversight allows an unauthenticated attacker to access data that they are not authorized to view, leading to information disclosure. This vulnerability affects the confidentiality of sensitive information."], "name": "CVE-2026-73229", "package_state": [{"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Out of support scope", "package_name": "ansible-automation-platform-24/controller-rhel8", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Out of support scope", "package_name": "ansible-automation-platform-24/eda-controller-rhel8", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Out of support scope", "package_name": "ansible-automation-platform-24/hub-rhel8", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Out of support scope", "package_name": "ansible-automation-platform-24/lightspeed-rhel8", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Out of support scope", "package_name": "ansible-automation-platform-25/controller-rhel8", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Out of support scope", "package_name": "ansible-automation-platform-25/eda-controller-rhel8", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Out of support scope", "package_name": "ansible-automation-platform-25/gateway-rhel8", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Out of support scope", "package_name": "ansible-automation-platform-25/hub-rhel8", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Out of support scope", "package_name": "ansible-automation-platform-25/lightspeed-rhel8", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform-26/controller-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform-26/eda-controller-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform-26/gateway-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform-26/hub-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform-26/lightspeed-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform-27/controller-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform-27/eda-controller-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform-27/gateway-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform-27/hub-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform-27/lightspeed-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform-27/metrics-service-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Out of support scope", "package_name": "ansible-automation-platform/automation-dashboard-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform-tech-preview/metrics-service-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "automation-controller", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Out of support scope", "package_name": "python-djangorestframework", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:discovery:2::el9", "fix_state": "Fix deferred", "package_name": "discovery/discovery-server-rhel9", "product_name": "Red Hat Discovery 2"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Fix deferred", "package_name": "python-djangorestframework", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Fix deferred", "package_name": "satellite/iop-advisor-backend-rhel9", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Fix deferred", "package_name": "tfm-pulpcore-python-djangorestframework", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:rhui:4::el8", "fix_state": "Out of support scope", "package_name": "python-djangorestframework", "product_name": "Red Hat Update Infrastructure 4 for Cloud Providers"}, {"cpe": "cpe:/a:redhat:rhui:5::el9", "fix_state": "Fix deferred", "package_name": "rhui5/rhua-rhel9", "product_name": "Red Hat Update Infrastructure 5"}], "public_date": "2026-08-11T18:59:34Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-73229\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-73229\nhttps://github.com/encode/django-rest-framework/commit/71f81946906e52f9dc8e5d22a0f3d2afa50c455e\nhttps://github.com/encode/django-rest-framework/commit/9e82afc98acfe6fc28c9bf78147f0c5b3f222cb5\nhttps://github.com/encode/django-rest-framework/pull/10012\nhttps://github.com/encode/django-rest-framework/releases/tag/3.17.2\nhttps://github.com/encode/django-rest-framework/security/advisories/GHSA-g47c-3xmw-q6m2"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.17.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "django-rest-framework", "source": "cna", "vendor": "encode"}, "product": "django_rest_framework", "vendor": "encode"}], "created": "2026-08-12T13:00:03.152354+00:00", "updated": "2026-08-13T14:15:05.225258+00:00", "vendors": ["encode", "encode$PRODUCT$django_rest_framework"]}