This vulnerability affects Django web framework versions 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. The issue arises because admin changelist forms that use the ModelAdmin.list_editable feature do not properly enforce authorization, permitting attackers with certain privileges to create new model instances by submitting forged POST requests. Unsupported earlier versions such as 5.0.x, 4.1.x, and 3.2.x were not evaluated but may also be vulnerable. The flaw is categorized under CWE-862, indicating missing authorization controls. The CVSS score is 2.7 (low severity), reflecting limited impact and requiring high privileges to exploit.

The vulnerability allows an attacker with administrative privileges to create new model instances through unauthorized POST requests in the Django admin interface. There is no impact on confidentiality or availability, and the integrity impact is limited to unauthorized creation of data entries. No known exploits are reported in the wild, and the overall severity is low.

Patch status is not yet confirmed — no official fix or patch links are provided in the available data. Users should monitor the official Django project advisories for updates and apply patches once released. Until then, review and restrict administrative access to trusted users only and consider disabling the use of ModelAdmin.list_editable in admin changelist forms if feasible.