Description

Django REST framework is a powerful and flexible toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's rest_framework/renderers.py AdminRenderer.render() uses override_method() to simulate GET and directly invokes view.get() without view.check_permissions() while rendering an invalid write request, allowing a 400 Bad Request HTML response to disclose data from a GET representation that the requester is not permitted to access. This issue is fixed in version 3.17.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-11T20:18:48.113Z",
  "pubdate": "2026-08-11T20:18:48.113Z",
  "executiveSummary": "An authorization bypass vulnerability exists in Django REST framework prior to version 3.17.2, specifically within the HTML rendering engine.\nThe vulnerability allows unauthorized users to disclose sensitive data from a GET representation by submitting an invalid write request that triggers a 400 Bad Request HTML response.\nThe affected component is the AdminRenderer implementation located in rest_framework/renderers.py.\nThe risk implications involve unauthorized data exposure of protected resources bypassing standard access control boundaries.\nAn attacker requires the ability to interact with the web API endpoints and submit malformed or invalid write requests to trigger the rendering flaw.\nNo complex exploitation requirements or prior authentication to the target GET representation are strictly enforced during the flawed rendering execution path, making it a significant security concern for applications utilizing the affected AdminRenderer.",
  "technicalDetails": "The root cause of the vulnerability stems from the improper handling of request method simulation within the AdminRenderer.render() function found in rest_framework/renderers.py.\nWhen rendering an invalid write request resulting in a 400 Bad Request status, the rendering mechanism utilizes override_method() to simulate a GET request.\nDuring this simulation, the framework directly invokes view.get() without executing view.check_permissions().\nConsequently, standard permission checks and access control validations enforced by the application are bypassed entirely.\nThe attack flow proceeds as follows: First, an unprivileged or unauthorized requester targets a write operation or sends a malformed write request that the API processes into an invalid state, generating a 400 Bad Request response.\nSecond, the AdminRenderer intercepts this error flow and invokes the override_method() utility to simulate a GET request to render the administrative error interface.\nThird, because view.get() is invoked directly, the framework omits the critical view.check_permissions() validation step.\nFinally, the resulting HTML error response contains data from the GET representation that the requester should otherwise not be permitted to access, directly leaking restricted information.\nThe affected versions include all releases of Django REST framework prior to version 3.17.2.\nThe vulnerability manifests within network-exposed web API applications utilizing the default browsable API or AdminRenderer features, exposing sensitive representations through unintended execution paths during error handling."
}