CVE-2026-87975: CWE-639: Authorization Bypass Through User-Controlled Key in djangoproject Django

The vulnerability in Django's BaseModelFormSet.save_existing_objects() method occurs because it uses the presence of a primary key on a submitted form instance as evidence that the instance belongs to the formset's limiting queryset. When the model's primary key is a field accepted by the form (such as OneToOneField, parent link, natural key, or UUID primary key), an attacker can forge management-form data to mark objects outside the queryset for deletion. This allows an authenticated user with permission to submit the formset to delete rows they do not have explicit permission to delete. Models using the default AutoField primary key are not vulnerable. Affected versions are Django 6.1 prior to 6.1.2, 6.0 prior to 6.0.9, and 5.2 prior to 5.2.18.

An authenticated user permitted to submit the affected formset can delete database rows outside the intended queryset without having permission on those objects. This results in an authorization bypass leading to unintended data deletion. There is no impact on confidentiality or availability, and no known exploitation in the wild has been reported.

A fix is available in Django versions 6.1.2, 6.0.9, and 5.2.18. Users should upgrade to these or later versions to remediate the vulnerability. No other mitigation is indicated by the vendor advisory.