This vulnerability arises from improper authorization checks in Django's admin changelist forms when using the ModelAdmin.list_editable feature. Specifically, it allows attackers to create new model instances by submitting forged POST requests, bypassing intended access controls. The issue affects Django versions 6.0 prior to 6.0.4, 5.2 prior to 5.2.13, and 4.2 prior to 4.2.30. Unsupported earlier versions may also be vulnerable. The vulnerability is categorized under CWE-862 (Missing Authorization). No CVSS score or official remediation guidance is provided in the available data.

The impact is unauthorized creation of new model instances through the Django admin interface, potentially leading to unauthorized data manipulation or escalation of privileges within affected Django applications. The exact impact depends on the application context and the models exposed via list_editable in the admin interface. There are no known exploits in the wild reported.

Patch status is not yet confirmed — check the official Django project advisory for current remediation guidance. Since the vulnerability affects specific Django versions prior to 6.0.4, 5.2.13, and 4.2.30, upgrading to these or later versions is likely recommended once confirmed. Until then, review admin interface configurations to limit exposure of list_editable fields and monitor for any unusual POST requests targeting the admin changelist forms.