CVE-2019-19118: Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing.

Security readout for executives and security teams

This flaw affects Django admin sites with a specific permission split. A staff user who could only view a parent record, but could edit an inline related record, was wrongly shown editing controls. That could change related data and trigger parent save side effects, without directly editing the parent object. Exposure is limited to applications using affected Django versions, Django admin, inline related model admin views, and staff users with view-only parent permissions plus edit rights on the inline model. Public anonymous exploitation is not indicated by the supplied sources. Treat this as a targeted administrative privilege issue, not a broad internet-facing remote exploit based on the supplied evidence. Prioritize upgrades where Django admin is enabled for many staff users or where model save side effects can trigger operational, financial, or access-control changes. Mitigation focus: Upgrade Django 2.1 deployments to 2.1.15 or later.; Upgrade Django 2.2 deployments to 2.2.8 or later.; Review OS or appliance vendor advisories for packaged Django fixes..

Prepared

Jun 6, 2026, 12:31 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.