CVE-2026-87975

Name of the Vulnerable Software and Affected Versions Django versions prior to 6.1.2 Django versions prior to 6.0.9 Django versions prior to 5.2.18

Description An issue exists in the save existing objects() function within django.forms.models.BaseModelFormSet. The function incorrectly uses the presence of a primary key on a submitted form instance to verify if the instance belongs to the formset's limiting queryset. When a model's primary key is a field accepted by the form—such as a OneToOneField, a parent link in an inline formset, or a natural/UUID primary key—an authenticated user can populate the primary key via submitted data. This allows a user to delete rows outside the limiting queryset by forging management-form data, even without permissions for the targeted object. Models using the default AutoField primary key are not affected.

Recommendations Update to version 6.1.2 or newer. Update to version 6.0.9 or newer. Update to version 5.2.18 or newer.