This vulnerability in Django's GenericInlineModelAdmin component allows attackers to bypass add permission checks on inline model instances by submitting forged POST requests. Affected versions include 6.0 prior to 6.0.4, 5.2 prior to 5.2.13, and 4.2 prior to 4.2.30. The flaw results from missing authorization validation, classified under CWE-862. Unsupported earlier Django versions such as 5.0.x, 4.1.x, and 3.2.x were not assessed but may also be vulnerable. The vulnerability was responsibly disclosed by N05ec@LZU-DSLab. No official patch or remediation level is currently provided in the data.

Successful exploitation could allow an unauthenticated attacker to perform unauthorized add operations on inline model instances within Django admin interfaces. This compromises confidentiality, integrity, and availability of affected Django applications. The CVSS 3.1 base score of 9.8 reflects network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on all security properties.

Patch status is not yet confirmed — check the official Django project advisory for current remediation guidance. Until an official fix is released, restrict access to Django admin interfaces and validate user permissions carefully. Monitor Django security channels for updates and apply patches promptly once available.