4.3
Medium
CVE-2026-73229 Django REST framework is a powerful and flexible toolkit for building Web APIs
Description
Django REST framework is a powerful and flexible toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's rest_framework/renderers.py AdminRenderer.render() uses override_method() to simulate GET and directly invokes view.get() without view.check_permissions() while rendering an invalid write request, allowing a 400 Bad Request HTML response to disclose data from a GET representation that the requester is not permitted to access. This issue is fixed in version 3.17.2.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| django-rest-framework 3.17 | earliest → < 3.17.2 | 3.17.2 |
References
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of django-rest-framework
The 5 CVEs of django-rest-framework →
CVE-2026-114138
Django REST framework is a toolkit for building Web APIs
7.5
High
CVE-2026-114137
Django REST framework is a toolkit for building Web APIs
7.4
High
CVE-2026-114136
Django REST framework is a toolkit for building Web APIs
7.5
High
CVE-2026-73228
Django REST framework is a toolkit for building Web APIs
5.3
Medium