CVE-2026-113733Low· 2.2▾ SunlitAn issue was discovered in Django 6.1 before 6.1.3 and 6.0 before 6.0.10. The `django.contrib.admin.utils.display_for_field()` function did not obfuscate the password field of user models other than `AUTH_USER_MODEL`, or of an `AUTH_USER…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 12.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.4%
An issue was discovered in Django 6.1 before 6.1.3 and 6.0 before 6.0.10.
The django.contrib.admin.utils.display_for_field() function did not obfuscate the password field of user models other than AUTH_USER_MODEL, or of an AUTH_USER_MODEL inheriting its password field from a concrete parent model through multi-table inheritance, which allows authenticated staff users with only the view permission on such a model to obtain full password hashes via the read-only change form.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.
Django would like to thank Aaron chen for reporting this issue.
django >= 6.1 < 6.1.3django >= 6.0 < 6.0.10Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114582Medium· 5.3Server-side request forgery via SpatialReference string input
CVE-2026-111362Medium· 5.3Server-side request forgery via crs member of GeoJSON geometries
CVE-2026-108147Medium· 5.3Potential memory exhaustion in MultiPartParser via base64-encoded file upload
CVE-2026-113593Low· 3.1Potential exposure of private data via empty and missing Vary headers
CVE-2026-111211Medium· 5.3Potential log injection via unescaped geometry form values
CVE-2026-84429Medium· 5.3An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. `django.utils.http.parse_header_parameters()` was subject to a potential denial-of-service attack due to quadratic time complexity when parsing …