An issue exists in the `save existing objects()` function within `django.forms.models.BaseModelFormSet`. The function incorrectly uses the presence of a primary key on a submitted form instance to verify if the instance belongs to the formset's limiting queryset. When a model's primary key is a field accepted by the form—such as a `OneToOneField`, a parent link in an inline formset, or a natural/UUID primary key—an authenticated user can populate the primary key via submitted data. This allows a user to delete rows outside the limiting queryset by forging management-form data, even without permissions for the targeted object. Models using the default AutoField primary key are not affected.