CVE-2026-87975

Django's BaseModelFormSet.save_existing_objects() treated a populated primary key on a submitted form instance as proof that the object belonged to the formset's limiting queryset, which is not a safe assumption when the primary key itself is an editable form field. An authenticated attacker who is allowed to submit a model formset (e.g., an inline formset in the admin or app UI) can forge management-form data marking an out-of-queryset object for deletion, causing rows outside the intended queryset to be deleted without any permission check on the targeted object. The flaw requires the model's primary key to be a field accepted by the form — such as a OneToOneField parent link on an inline formset model, or a UUID/natural primary key — while models using the default AutoField primary key are not affected. Applications running Django 6.1 before 6.1.2, 6.0 before 6.0.9, or 5.2 before 5.2.18 are affected, and earlier unsupported series (5.1.x, 5.0.x, 4.2.x) were not evaluated and may also be vulnerable. There is no known public proof of concept and no indication of exploitation in the wild; the issue is not on the CISA KEV catalog.

What to do: Upgrade immediately to Django 6.1.2, 6.0.9, or 5.2.18 depending on your series; if you are on an unsupported series (4.2, 5.0, 5.1), move to a supported fixed release since no backport is provided. Audit any use of model formsets or inline formsets (including Django admin inlines) whose models use a OneToOneField parent link, UUID, or natural key as the primary key exposed in the form — models with the default AutoField primary key are not affected. Until patched, restrict which authenticated users can submit such formsets and review logs for management-form submissions marking unexpected objects for deletion.