CVE-2026-4277 is a missing authorization vulnerability (CWE-862) in the Django web framework affecting versions 6.0 prior to 6.0.4, 5.2 prior to 5.2.13, and 4.2 prior to 4.2.30. The flaw occurs because Django's GenericInlineModelAdmin does not validate permissions on inline model instances when processing forged POST requests, potentially allowing unauthorized data manipulation. Earlier unsupported versions such as 5.0.x, 4.1.x, and 3.2.x may also be vulnerable but were not assessed. The vulnerability is rated critical with a CVSS 3.1 base score of 9.8, reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. No official patch or remediation level is documented in the provided information, and no known exploits have been observed in the wild.

Successful exploitation of this vulnerability could allow an attacker to bypass authorization controls and manipulate inline model data within Django admin interfaces. This could lead to unauthorized data modification, disclosure, or deletion, severely impacting the confidentiality, integrity, and availability of affected Django applications. The CVSS score of 9.8 underscores the critical nature of this issue. However, no known exploits have been reported to date.

Patch status is not yet confirmed — check the official Django project advisory for current remediation guidance. Until an official fix is available, administrators should consider restricting access to Django admin interfaces and carefully validate user permissions to mitigate potential exploitation. Monitor Django project communications for updates on patches or official fixes.