CVE-2026-113733 Details
Description
An issue was discovered in Django 6.1 before 6.1.3 and 6.0 before 6.0.10. The `django.contrib.admin.utils.display_for_field()` function did not obfuscate the password field of user models other than `AUTH_USER_MODEL`, or of an `AUTH_USER_MODEL` inheriting its password field from a concrete parent model through multi-table inheritance, which allows authenticated staff users with only the view permission on such a model to obtain full password hashes via the read-only change form. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Aaron chen for reporting this issue.
A vulnerability exists in Django's admin interface that allows for password hash disclosure to admin users with view-only permissions on certain user models. This issue is present in Django versions 6.1 prior to 6.1.3 and 6.0 prior to 6.0.10. The vulnerability arises because the admin interface only obfuscates password hashes for the default user model. When custom user models, or models inheriting from a concrete parent through multi-table inheritance, are used, the full password hash is visible to users with view permissions.
Upgrade to Django versions 6.1.3, 6.0.10, or 5.2.19, all of which include the necessary patch. Instructions for downloading these versions are available on the Django website.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 3, 2026CISA-ADP
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://docs.djangoproject.com/en/dev/releases/security/ | Django Software Foundation | AdvisoryBundleRemedyVendor |
| https://github.com/django/django/commit/67cce9dcd23ddeec41ccf0abfe3431e3cd724365 | Django Software Foundation | Source CodeVendor |
| https://github.com/django/django/commit/7d875c0a49d2a59335c65f6bf57970a5bac03be2 | Django Software Foundation | Source CodeVendor |
| https://github.com/django/django/commit/f5b039a619b3b5394ea5b966e17c7546fda6f937 | Django Software Foundation | Source CodeVendor |
| https://groups.google.com/g/django-announce | Django Software Foundation | |
| https://www.djangoproject.com/weblog/2026/nov/03/security-releases/ | Django Software Foundation | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-522 | Insufficiently Protected Credentials | Django Software Foundation |
Affected Products
| Product | Versions |
|---|---|
| Django | < 6.1.3 (semver) < 6.0.10 (semver) ~5.1 ~5.0 ~4.2 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | CVE Modified | CISA-ADP |
| Nov 3, 2026 | New CVE Received | Django Software Foundation |