---
id: "CVE-2026-113733"
kind: "vulnerability"
aliases: ["CVE-2026-113733"]
title: "Django: admin read-only form exposes password hashes to view-only staff"
severity: "low"
cvss: 2.2
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["django", "package", "python", "self-hosted"]
not_affected_if: ["auth-user-model-default", "no-django-admin", "no-view-only-staff"]
published_at: "2026-11-03T16:17:19+00:00"
first_seen_at: "2026-11-03T16:21:42+00:00"
updated_at: "2026-11-03T16:24:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113733", "first_seen_at": "2026-11-03T16:21:42+00:00"}]
---

# Django: admin read-only form exposes password hashes to view-only staff

Django's admin does not hide the password field on some user models, so staff users with only view permission can see full password hashes on the read-only change form. An attacker who holds such a staff account can take the hashes offline and try to crack them.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `python -m django --version` and compare against the fixed ranges below.
- Check whether any custom user model is registered in the admin without a password field override, or whether `AUTH_USER_MODEL` inherits its password field from a concrete parent model via multi-table inheritance.

## Fix

- Django 6.1: upgrade to `6.1.3` or later.
- Django 6.0: upgrade to `6.0.10` or later.
- Earlier unsupported series (such as 5.1.x, 5.0.x, 4.2.x) were not evaluated and may also be affected; the sources do not give a fixed version for them.

## Timeline

- 2026-11-03T16:21:42+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113733

## Documents

- [fix] Patch: github.com https://github.com/django/django/commit/67cce9dcd23ddeec41ccf0abfe3431e3cd724365
- [fix] Patch: github.com https://github.com/django/django/commit/7d875c0a49d2a59335c65f6bf57970a5bac03be2
- [fix] Patch: github.com https://github.com/django/django/commit/f5b039a619b3b5394ea5b966e17c7546fda6f937

## From the sources

An issue was discovered in Django 6.1 before 6.1.3 and 6.0 before 6.0.10.
The `django.contrib.admin.utils.display_for_field()` function did not obfuscate the password field of user models other than `AUTH_USER_MODEL`, or of an `AUTH_USER_MODEL` inheriting its password field from a concrete parent model through multi-table inheritance, which allows authenticated staff users with only the view permission on such a model to obtain full password hashes via the read-only change form.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.
Django would like to thank Aaron chen for reporting this issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_