{"id":"CVE-2026-113733","kind":"vulnerability","aliases":["CVE-2026-113733"],"related":[],"title":"Django: admin read-only form exposes password hashes to view-only staff","description":"An issue was discovered in Django 6.1 before 6.1.3 and 6.0 before 6.0.10.\nThe `django.contrib.admin.utils.display_for_field()` function did not obfuscate the password field of user models other than `AUTH_USER_MODEL`, or of an `AUTH_USER_MODEL` inheriting its password field from a concrete parent model through multi-table inheritance, which allows authenticated staff users with only the view permission on such a model to obtain full password hashes via the read-only change form.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank Aaron chen for reporting this issue.","summary":"Django's admin does not hide the password field on some user models, so staff users with only view permission can see full password hashes on the read-only change form. An attacker who holds such a staff account can take the hashes offline and try to crack them.","severity":"low","cvss":2.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["django","package","python","self-hosted"],"not_affected_if":["auth-user-model-default","no-django-admin","no-view-only-staff"],"how_to_check":"- Run `python -m django --version` and compare against the fixed ranges below.\n- Check whether any custom user model is registered in the admin without a password field override, or whether `AUTH_USER_MODEL` inherits its password field from a concrete parent model via multi-table inheritance.","fix":"- Django 6.1: upgrade to `6.1.3` or later.\n- Django 6.0: upgrade to `6.0.10` or later.\n- Earlier unsupported series (such as 5.1.x, 5.0.x, 4.2.x) were not evaluated and may also be affected; the sources do not give a fixed version for them.","status":"open","published_at":"2026-11-03T16:17:19+00:00","first_seen_at":"2026-11-03T16:21:42+00:00","triaged_at":"2026-11-03T16:24:29+00:00","updated_at":"2026-11-03T16:24:29+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-03T16:24:29Z","model":"claude-haiku-5-5","output":{"fix":"- Django 6.1: upgrade to `6.1.3` or later.\n- Django 6.0: upgrade to `6.0.10` or later.\n- Earlier unsupported series (such as 5.1.x, 5.0.x, 4.2.x) were not evaluated and may also be affected; the sources do not give a fixed version for them.","reach":"internet","title":"Django: admin read-only form exposes password hashes to view-only staff","impact":"medium","summary":"Django's admin does not hide the password field on some user models, so staff users with only view permission can see full password hashes on the read-only change form. An attacker who holds such a staff account can take the hashes offline and try to crack them.","audience":"businesses","category":"package","nicknames":[],"who_cares":["django","python","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Staff user reads password hashes of other user accounts","analyst_note":"","how_to_check":"- Run `python -m django --version` and compare against the fixed ranges below.\n- Check whether any custom user model is registered in the admin without a password field override, or whether `AUTH_USER_MODEL` inherits its password field from a concrete parent model via multi-table inheritance.","plain_action":"","needs_analyst":false,"not_affected_if":["no-django-admin","auth-user-model-default","no-view-only-staff"],"who_is_affected":"Only sites running Django 6.1 before 6.1.3 or 6.0 before 6.0.10 that use the admin site with staff accounts that have view permission on user models. The exposure depends on a non-default user model or on the password field being inherited through multi-table inheritance. Sites without the Django admin, or with no staff users holding view permissions on user models, are unlikely to be affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000753,"input_tokens":4301,"output_tokens":645,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-113733':17A,20A '-2026':16A,19A '4.2':165C '5.0':162C '5.1':160C '6.0':86C '6.0.10':88C '6.1':82C '6.1.3':84C 'aaron':180C 'account':66B 'admin':2A,29B 'affect':174C 'allow':129C 'also':172C 'attack':60B 'auth':105C,111C 'authent':130C 'chang':57B,152C 'chen':181C 'concret':120C 'crack':75B 'cve':15A,18A 'discov':79C 'django':1A,21B,27B,81C,156C,175C 'django.contrib.admin.utils.display':90C 'earlier':154C 'evalu':169C 'expos':7A 'field':35B,92C,99C,117C 'form':6A,58B,153C 'full':49B,144C 'function':93C 'hash':9A,51B,70B,146C 'hide':32B 'hold':62B 'host':26B 'inherit':114C,127C 'issu':77C,185C 'like':177C 'may':171C 'model':39B,102C,107C,113C,122C,141C 'multi':125C 'multi-t':124C 'obfusc':96C 'obtain':143C 'offlin':71B 'packag':22B 'parent':121C 'password':8A,34B,50B,98C,116C,145C 'permiss':46B,137C 'python':23B 'read':4A,55B,150C 'read-on':3A,54B,149C 'report':183C 'see':48B 'self':25B 'self-host':24B 'seri':157C 'staff':14A,41B,65B,131C 'tabl':126C 'take':68B 'thank':179C 'tri':73B 'unsupport':155C 'user':38B,42B,101C,106C,112C,132C 'via':147C 'view':12A,45B,136C 'view-on':11A 'would':176C 'x':161C,163C,166C","nicknames":[],"mitigations":[],"who_affected":"Only sites running Django 6.1 before 6.1.3 or 6.0 before 6.0.10 that use the admin site with staff accounts that have view permission on user models. The exposure depends on a non-default user model or on the password field being inherited through multi-table inheritance. Sites without the Django admin, or with no staff users holding view permissions on user models, are unlikely to be affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["django","low","package","python","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-03T16:17:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113733","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113733","severity":null,"published_at":"2026-11-03T16:17:19+00:00","modified_at":"2026-11-03T16:17:19+00:00","first_seen_at":"2026-11-03T16:21:42+00:00","fetched_at":"2026-11-03T16:21:42+00:00","note":null}],"documents":[{"id":58793,"url":"https://github.com/django/django/commit/67cce9dcd23ddeec41ccf0abfe3431e3cd724365","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":58794,"url":"https://github.com/django/django/commit/7d875c0a49d2a59335c65f6bf57970a5bac03be2","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":58795,"url":"https://github.com/django/django/commit/f5b039a619b3b5394ea5b966e17c7546fda6f937","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}