CVE-2016-2048

Severity: medium (CVSS 5.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-02-08 · updated 2026-06-17
Weakness: CWE-284

Description

Django 1.9.x before 1.9.2, when ModelAdmin.save_as is set to True, allows remote authenticated users to bypass intended access restrictions and create ModelAdmin objects via the "Save as New" option when editing objects and leveraging the "change" permission.

Affected products

Django: 1.9, 1.9.1

References

http://www.securityfocus.com/bid/82329
http://www.securitytracker.com/id/1034894
https://www.djangoproject.com/weblog/2016/feb/01/releases-192-and-189/
http://www.securityfocus.com/bid/82329
http://www.securitytracker.com/id/1034894
https://www.djangoproject.com/weblog/2016/feb/01/releases-192-and-189/

Get alerted when CVE-2016-2048 or the next vulnerability affects your stack