{"id":"CVE-2019-19118","details":"Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. A Django model admin displaying inline related models, where the user has view-only permissions to a parent model but edit permissions to the inline model, would be presented with an editing UI, allowing POST requests, for updating the inline model. Directly editing the view-only parent model was not possible, but the parent model's save() method was called, triggering potential side effects, and causing pre and post-save signal handlers to be invoked. (To resolve this, the Django admin is adjusted to require edit permissions on the parent model in order for inline models to be editable.)","aliases":["GHSA-hvmf-r92r-27hr","PYSEC-2019-15"],"modified":"2026-03-20T03:26:56.115401Z","published":"2019-12-02T14:15:10.880Z","related":["openSUSE-SU-2024:11205-1","openSUSE-SU-2024:13887-1","openSUSE-SU-2024:14208-1","openSUSE-SU-2026:10005-1"],"references":[{"type":"WEB","url":"https://groups.google.com/forum/#%21topic/django-announce/GjGqDvtNmWQ"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6R4HD22PVEVQ45H2JA2NXH443AYJOPL5/"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/202004-17"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20191217-0003/"},{"type":"FIX","url":"http://www.openwall.com/lists/oss-security/2019/12/02/1"},{"type":"FIX","url":"https://docs.djangoproject.com/en/dev/releases/security/"},{"type":"FIX","url":"https://www.djangoproject.com/weblog/2019/dec/02/security-releases/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/django/django","events":[{"introduced":"df591468251ed489a3e147d7c359f387f4effe66"},{"fixed":"3baf68b4efc660ff68fd246d2f7092bfd42a7a4a"},{"introduced":"2a62cdcfec85938f40abb2e9e6a9ff497e02afe8"},{"fixed":"b8782c52c99175916a1dceaece758608ac5856d0"}],"database_specific":{"versions":[{"introduced":"2.1"},{"fixed":"2.1.15"},{"introduced":"2.2"},{"fixed":"2.2.8"}]}}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-19118.json","unresolved_ranges":[{"events":[{"introduced":"0"},{"last_affected":"31"}]}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"}]}