CVE-2026-113733 json
Password hash disclosure to "view only" admin users with custom user models
published 2026-11-03 5 d ago modified 2026-11-03 5 d ago also EUVD-2026-116022
- cvss
- 2.2
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 33%
- public exploits
- 0
- none known
Summary
An issue was discovered in Django 6.1 before 6.1.3 and 6.0 before 6.0.10. The `django.contrib.admin.utils.display_for_field()` function did not obfuscate the password field of user models other than `AUTH_USER_MODEL`, or of an `AUTH_USER_MODEL` inheriting its password field from a concrete parent model through multi-table inheritance, which allows authenticated staff users with only the view permission on such a model to obtain full password hashes via the read-only change form. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Aaron chen for reporting this issue.
Patch / fix
- djangoproject Django 6.0.10, 6.1.3
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 5 d ago
Exploit prediction
0.39% chance of exploitation in the next 30 days, higher than 33% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 2.2 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N |
| CNA | 4.0 | 2.1 | CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
| CNA | 4.0 | 2.1 | CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- djangoproject Django
Classification
- Weakness
-
- CWE-522 Insufficiently Protected Credentials
- Technology feeds
References
-
github.com
/django/django/commit/f5b039a619b3b5394ea5b966e17c7546fda6f937
patch
-
github.com
/django/django/commit/7d875c0a49d2a59335c65f6bf57970a5bac03be2
patch
-
github.com
/django/django/commit/67cce9dcd23ddeec41ccf0abfe3431e3cd724365
patch
-
docs.djangoproject.com
/en/dev/releases/security/
vendor-advisory
-
djangoproject.com
/weblog/2026/nov/03/security-releases/
vendor-advisory
-
groups.google.com
/g/django-announce
mailing-list
Sources
- CVE List CVE-2026-113733
- NVD CVE-2026-113733
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.