Search: CVE-2026-87975

CVE-2026-87975 is an authorization bypass vulnerability in Django affecting versions 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. The issue arises in django.forms.models.BaseModelFormSet.save_existing_objects(), which incorrectly trusts the presence of a primary key on a submitted form's instance as proof that the instance belongs to the formset's limiting queryset. This flaw allows an authenticated user with permission to submit such a formset to delete objects outside the intended queryset by submitting forged management-form data. Models using the default AutoField primary key are not affected. The vulnerability has a medium severity with a CVSS score of 4.3.