Arch Linux Security Advisory ASA-201602-1 ========================================= Severity: Medium Date : 2016-02-02 CVE-ID : CVE-2016-2048 Package : python-django Type : permission bypass Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package python-django before version 1.9.2-1 is vulnerable to permission bypass. Resolution ========== Upgrade to 1.9.2-1. # pacman -Syu "python-django>=1.9.2-1" The problem has been fixed upstream in version 1.9.2. Workaround ========== None. Description =========== If a ModelAdmin uses save_as=True (not the default), the admin provides an option when editing objects to "Save as new". A regression in Django 1.9 prevented that form submission from raising a "Permission Denied" error for users without the "add" permission. Impact ====== A remote attacker with django User account and change permissions but not "add" might be able to create objects for ModelAdmin with save=True. References ========== https://www.djangoproject.com/weblog/2016/feb/01/releases-192-and-189/ https://access.redhat.com/security/cve/CVE-2016-2048