An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. (CVE-2026-87975)

The vulnerability (CVE-2026-87975) affects Django's form handling in versions prior to 6.1.2, 6.0.9, and 5.2.18. The method django.forms.models.BaseModelFormSet.save_existing_objects() uses the presence of a primary key on a submitted form instance to assume the instance belongs to the formset's limiting queryset. However, if the primary key is a field accepted by the form (e.g., OneToOneField, parent link, natural key, or UUID), an attacker with permission to submit the formset can craft management-form data to mark objects outside the queryset for deletion, bypassing object-level permissions. This issue does not affect models using the default AutoField primary key. Earlier unsupported Django versions may also be affected but were not evaluated.

An authenticated user with permission to submit a formset can delete database rows outside the intended queryset without having explicit permission on those objects. This could lead to unauthorized data deletion. There is no impact on confidentiality or availability, and models using the default AutoField primary key are not vulnerable.

Official fixes are available in Django versions 6.1.2, 6.0.9, and 5.2.18. Users should upgrade to these or later versions to remediate the vulnerability. Since this is a code-level issue in Django, no other mitigations are specified. Patch status is confirmed by the version numbers indicating fixed releases.