CVE-2026-73229

Received Received - Intake

Django REST Framework AdminRenderer Data Exposure via GET Request

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: GitHub, Inc.

Description

Django REST framework is a powerful and flexible toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's rest_framework/renderers.py AdminRenderer.render() uses override_method() to simulate GET and directly invokes view.get() without view.check_permissions() while rendering an invalid write request, allowing a 400 Bad Request HTML response to disclose data from a GET representation that the requester is not permitted to access. This issue is fixed in version 3.17.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-11

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-73229

EUVD

EUVD-2026-56888

Affected Vendors & Products

Vendor	Product	Version / Range
encode	django_rest_framework	3.17.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability in Django REST Framework (fixed in version 3.17.2) involves the AdminRenderer component. When processing an invalid write request (like POST) that returns a 400 error, the renderer simulates a GET request to display error details. However, it bypasses permission checks, potentially exposing data that should only be accessible via authorized GET requests.

Detection Guidance

To detect this vulnerability, check if your Django REST Framework version is below 3.17.2. Run: pip show djangorestframework. If version is <=3.17.1, the system is vulnerable. Also inspect AdminRenderer usage in HTML responses for GET-protected data leaks during POST validation errors.

Impact Analysis

If you use Django REST Framework with AdminRenderer enabled, an attacker could exploit this to view sensitive data they are not authorized to access. This happens only when HTML content negotiation is used, write methods are permitted, GET requests are denied, and an invalid write request triggers a 400 error.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating principles of least privilege and data protection. It may result in non-compliance with GDPR (data protection), HIPAA (patient data privacy), or other regulations requiring strict access controls and data confidentiality.

Mitigation Strategies

Upgrade Django REST Framework to version 3.17.2 or later immediately. Run: pip install --upgrade djangorestframework. After upgrading, verify the fix by testing AdminRenderer behavior with invalid POST requests to ensure no GET-protected data is exposed in error responses.

Hi! I’m here to help you understand CVE-2026-73229. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70