{"action":"Upgrade django to 4.2.16 or later.","affected":[{"fixed":"4.2.16","introduced":"0"},{"fixed":"5.0.9","introduced":"5.0"},{"fixed":"5.1.1","introduced":"5.1"}],"component":"django","cve_ids":["CVE-2024-45231"],"ecosystem":"PyPI","epss":0.00788,"exploited":false,"fixed_versions":["4.2.16","5.0.9","5.1.1"],"ghsa_id":"GHSA-rrqc-c2jx-6jgv","id":"tcs_01M5KGRR6WB5AR25D1TWXSN22S","modified_at":"2026-07-07T17:57:34.018251439Z","published_at":"2026-07-07T14:34:42.697597Z","references":["https://osv.dev/vulnerability/PYSEC-2026-1297","https://nvd.nist.gov/vuln/detail/CVE-2024-45231","https://github.com/django/django/commit/3c733c78d6f8e50296d6e248968b6516c92a53ca","https://github.com/django/django/commit/96d84047715ea1715b4bd1594e46122b8a77b9e2","https://github.com/django/django/commit/bf4888d317ba4506d091eeac6e8b4f1fcc731199","https://docs.djangoproject.com/en/dev/releases/security","https://github.com/django/django","https://groups.google.com/forum/#%21forum/django-announce","https://www.djangoproject.com/weblog/2024/sep/03/security-releases","https://pypi.org/project/django","https://github.com/advisories/GHSA-rrqc-c2jx-6jgv"],"severity":{"label":"low","score":3.7},"sources":[{"source":"osv","source_id":"PYSEC-2026-1297","url":"https://osv.dev/vulnerability/PYSEC-2026-1297"}],"summary":"Django allows enumeration of user e-mail addresses"}