CVE-2026-6579 Details
Description
A weakness has been identified in liangliangyy DjangoBlog up to 2.1.0.0. This impacts an unknown function of the file blog/views.py of the component Clean Endpoint. This manipulation causes missing authentication. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability exists in liangliangyy DjangoBlog versions through 2.1.0.0, specifically in the Clean Endpoint located in blog/views.py. This vulnerability allows unauthenticated users to purge the application cache remotely, leading to a cache stampede denial-of-service condition by forcing all requests to bypass the cache and directly access the database.
It is recommended to add authentication requirements to the /clean endpoint by using the @login_required and @staff_member_required decorators.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 19, 2026CISA-ADP
Assessed Apr 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/3em0/cve_repo/blob/main/DjangoBlog/Vuln-4-Unauthenticated-Cache-Purge.md | [email protected] | ExploitTechnical Description |
| https://vuldb.com/submit/790286 | [email protected] | Technical Description |
| https://vuldb.com/vuln/358214 | [email protected] | AdvisoryExploitPartial Content |
| https://vuldb.com/vuln/358214/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| liangliangyy DjangoBlog | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Apr 19, 2026 | New CVE Received | [email protected] |