{"action":"Upgrade djangorestframework to 3.17.2 or later.","affected":[{"fixed":"3.17.2","introduced":"0"}],"component":"djangorestframework","cve_ids":["CVE-2026-73229"],"ecosystem":"PyPI","epss":0.00373,"exploited":false,"fixed_versions":["3.17.2"],"ghsa_id":"GHSA-g47c-3xmw-q6m2","id":"tcs_01M5KH80XHE65PDV3AQVZ7ZA8V","modified_at":"2026-09-10T12:15:04.001259003Z","published_at":"2026-09-10T09:44:58.942329Z","references":["https://osv.dev/vulnerability/PYSEC-2026-3828","https://github.com/encode/django-rest-framework/security/advisories/GHSA-g47c-3xmw-q6m2","https://nvd.nist.gov/vuln/detail/CVE-2026-73229","https://github.com/encode/django-rest-framework/pull/10012","https://github.com/encode/django-rest-framework/commit/71f81946906e52f9dc8e5d22a0f3d2afa50c455e","https://github.com/encode/django-rest-framework/commit/9e82afc98acfe6fc28c9bf78147f0c5b3f222cb5","https://github.com/encode/django-rest-framework","https://github.com/encode/django-rest-framework/releases/tag/3.17.2","https://pypi.org/project/djangorestframework","https://github.com/advisories/GHSA-g47c-3xmw-q6m2"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"PYSEC-2026-3828","url":"https://osv.dev/vulnerability/PYSEC-2026-3828"}],"summary":"Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests"}