CVE-2007-0405 json
Django Improper Access Control
published 2007-01-23 19 y ago modified 2026-07-06 4 mo ago also GHSA-mwv2-398h-v489 , PYSEC-2026-629 , EUVD-2022-4642
- cvss
- 6.5
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.3%
- EPSS 1.3% chance of exploitation in 30 days, percentile 70%
- public exploits
- 0
- none known
Summary
The LazyUser class in the AuthenticationMiddleware for Django 0.95 does not properly cache the user name across requests, which allows remote authenticated users to gain the privileges of a different user.
Patch / fix
- pypi django 1.0
- python-django Debian 14, Debian 13, Debian 12 0.95.1-1
debian advisories DEBIAN-CVE-2007-0405
- github.com/django/django@3c57822 commit
- github.com/django/django@e89f0a6 commit
- secunia.com/advisories/23826 advisory
Exploit prediction
1.31% chance of exploitation in the next 30 days, higher than 70% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | django | >=0.95, <1.0 |
1.0 |
Classification
- Technology feeds
References
-
secunia.com
/advisories/23826
third-party-advisory, patch, vendor-advisory
-
github.com
/django/django/commit/3c5782287e
web
-
github.com
/django/django/commit/e89f0a65581f82a5740bfe989136cea75d09cd67
web
-
exchange.xforce.ibmcloud.com
/vulnerabilities/31628
vdb-entry, web
-
code.djangoproject.com
/changeset/3754
web
-
securityfocus.com
/bid/22138
vdb-entry
-
nvd.nist.gov
/vuln/detail/CVE-2007-0405
advisory
-
github.com
/django/django
package
-
pypi.org
/project/django
package
-
github.com
/advisories/GHSA-mwv2-398h-v489
advisory
Sources
- CVE List CVE-2007-0405
- GitHub Advisory GHSA-mwv2-398h-v489
- NVD CVE-2007-0405
- OSV PYSEC-2026-629
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.