CVE-2026-73229

Django REST framework is a powerful and flexible toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's rest_framework/renderers.py AdminRenderer.render() uses override_method() to simulate GET and directly invokes view.get() without view.check_permissions() while rendering an invalid write request, allowing a 400 Bad Request HTML response to disclose data from a GET representation that the requester is not permitted to access. This issue is fixed in version 3.17.2.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-200"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73229.json"
}

References

Affected packages

Git / github.com/encode/django-rest-framework

Affected ranges

Type

GIT

Repo

https://github.com/encode/django-rest-framework

Events

Introduced

Fixed

71f81946906e52f9dc8e5d22a0f3d2afa50c455e

Fixed

9e82afc98acfe6fc28c9bf78147f0c5b3f222cb5

Fixed

ad309f3e18aa5591db87a8fc959dc4564c000324

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "3.17.2"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*

0.1

0.2.4

0.3.1

0.3.2

0.3.3

0.4.0

2.*

2.0.0

2.0.1

2.0.2

2.1.0

2.1.1

2.1.10

2.1.11

2.1.12

2.1.13

2.1.14

2.1.15

2.1.16

2.1.17

2.1.2

2.1.3

2.1.4

2.1.5

2.1.6

2.1.7

2.1.8

2.1.9

2.2.0

2.2.1

2.2.2

2.2.3

2.2.4

2.2.6

2.2.7

2.3.0

2.3.1

2.3.10

2.3.11

2.3.12

2.3.13

2.3.14

2.3.2

2.3.3

2.3.4

2.3.5

2.3.6

2.3.7

2.3.8

2.3.9

2.4.0

2.4.1

2.4.2

2.4.3

2.4.4

3.*

3.0.0

3.0.1

3.0.2

3.0.3

3.0.4

3.0.5

3.1.0

3.1.1

3.1.2

3.1.3

3.10.0

3.10.1

3.10.2

3.10.3

3.11.0

3.12.0

3.12.1

3.12.3

3.12.4

3.13.0

3.13.1

3.14.0

3.15.0

3.15.1

3.15.2

3.16.0

3.16.1

3.17.0

3.17.1

3.2.0

3.2.1

3.2.2

3.2.3

3.2.4

3.3.1

3.3.2

3.4.0

3.4.1

3.4.2

3.4.3

3.4.4

3.4.5

3.4.6

3.4.7

3.5.0

3.5.1

3.5.2

3.5.3

3.5.4

3.6.0

3.6.1

3.6.2

3.6.3

3.6.4

3.7.0

3.7.1

3.7.2

3.7.3

3.7.4

3.7.5

3.7.6

3.7.7

3.8.0

3.8.1

3.8.2

3.9.1

3.9.2

3.9.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73229.json"