-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the order of operations in changeform_view. The original code reset object_id and obj to None when handling '_saveasnew' POST requests, which triggered the 'add' path (object_id=None implies add operation). However, the permission check for 'add' wasn't properly enforced in this flow. The patch fixes this by moving the object_id reset earlier and explicitly setting add=False after handling '_saveasnew', ensuring the 'change' permission template/path is used. The commit diff and CVE description confirm this was the flawed logic path.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| django | pip | >= 1.9, < 1.9.2 | 1.9.2 |
PythonPythonOngoing coverage of React2Shell