CVE-2026-15920 is an XSS vulnerability in Django's admin interface affecting versions 5.2 prior to 5.2.17 and 6.0 prior to 6.0.8. The function django.contrib.admin.utils.display_for_field() renders URLField values as clickable links without validating the URL scheme, allowing unsafe schemes to be rendered and exploited for cross-site scripting against staff users. Exploitation requires that unsafe URL values are already stored in the database, which can occur if model validation is bypassed, for example via direct queryset writes or deserialization of untrusted input. The vulnerability is tracked under CWE-83 (Improper Neutralization of Script in Attributes).

This vulnerability enables cross-site scripting attacks against staff users of the Django admin interface if they click on maliciously crafted URLField links containing unsafe URL schemes stored in the database. The impact is limited to scenarios where unsafe URL data is persisted without validation, potentially leading to information disclosure or session hijacking through XSS. The CVSS score of 6.1 reflects a medium severity with network attack vector, low attack complexity, no privileges required, user interaction needed, and partial confidentiality and integrity impact.

A fix is available in Django versions 5.2.17 and later and 6.0.8 and later. Users should upgrade to these or later versions to remediate the vulnerability. Until upgraded, ensure that URLField data is validated before being stored in the database to prevent unsafe URL schemes. Avoid persisting URLField data through direct database writes, deserialization, or bulk imports without validation. No additional vendor advisory content was provided, so check the official Django release notes for detailed patch information.