CVE-2026-73229
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
Django REST framework prior to 3.17.2 has a vulnerability in AdminRenderer.render() that uses override_method() to simulate GET and directly invokes view.get() without view.check_permissions() while rendering an invalid write request, allowing a 400 Bad Request HTML response to disclose data from a GET representation that the requester is not permitted to access.
Risk Assessment
The risk includes unauthorized disclosure of sensitive data in error responses, potentially breaking access control in applications using Django REST framework.
Recommendation
Upgrade Django REST framework to version 3.17.2 or later, which includes a fix.
Original NVD description (English source)
Django REST framework is a powerful and flexible toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's rest_framework/renderers.py AdminRenderer.render() uses override_method() to simulate GET and directly invokes view.get() without view.check_permissions() while rendering an invalid write request, allowing a 400 Bad Request HTML response to disclose data from a GET representation that the requester is not permitted to access. This issue is fixed in version 3.17.2.