SUSE CVE-2026-114137

Django REST framework is a toolkit for building Web APIs. From 3.12.0 until 3.18.2, TokenProxy.delete in restframework/authtoken/models.py uses the proxy's user-id pk while the concrete Token token-string primary key identifies rows, so Django issues a deletion query that matches no row and repor...

Linux Distros Unpatched Vulnerability : CVE-2026-114137

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Django REST framework is a toolkit for building Web APIs. From 3.12.0 until 3.18.2, TokenProxy.delete in restframework/authtoken/models.py uses the proxy's...

EUVD-2026-107547

Django REST framework: TokenProxy.delete reports success and revokes nothing...

Insufficient Session Expiration

Overview djangorestframework is a powerful and flexible toolkit for building Web APIs. Affected versions of this package are vulnerable to Insufficient Session Expiration via TokenProxy.delete and the proxy queryset's delete method in restframework/authtoken/models.py. Because TokenProxy maps pk ...

CVE-2026-114137

Django REST framework is a toolkit for building Web APIs. From 3.12.0 until 3.18.2, TokenProxy.delete in restframework/authtoken/models.py uses the proxy's user-id pk while the concrete Token token-string primary key identifies rows, so Django issues a deletion query that matches no row and repor...

DEBIAN-CVE-2026-114137

Django REST framework is a toolkit for building Web APIs. From 3.12.0 until 3.18.2, TokenProxy.delete in restframework/authtoken/models.py uses the proxy's user-id pk while the concrete Token token-string primary key identifies rows, so Django issues a deletion query that matches no row and repor...

CVE-2026-114137

The Django REST framework (versions 3.12.0 through 3.18.2) contains a flaw in rest_framework/authtoken/models.py where the TokenProxy.delete() method incorrectly reports success without actually revoking any tokens. The root cause is that the method uses the proxy's user-id pk instead of the toke...

CVE-2026-114137 Django REST framework: TokenProxy.delete() reports success and revokes nothing

Django REST framework is a toolkit for building Web APIs. From 3.12.0 until 3.18.2, TokenProxy.delete in restframework/authtoken/models.py uses the proxy's user-id pk while the concrete Token token-string primary key identifies rows, so Django issues a deletion query that matches no row and repor...

CVE-2026-114137 Django REST framework: TokenProxy.delete() reports success and revokes nothing

Django REST framework is a toolkit for building Web APIs. From 3.12.0 until 3.18.2, TokenProxy.delete in restframework/authtoken/models.py uses the proxy's user-id pk while the concrete Token token-string primary key identifies rows, so Django issues a deletion query that matches no row and repor...

CVE-2026-114137

Django REST framework is a toolkit for building Web APIs. From 3.12.0 until 3.18.2, TokenProxy.delete in restframework/authtoken/models.py uses the proxy's user-id pk while the concrete Token token-string primary key identifies rows, so Django issues a deletion query that matches no row and repor...

CVE-2026-114137 Django REST framework: TokenProxy.delete() reports success and revokes nothing

Django REST framework is a toolkit for building Web APIs. From 3.12.0 until 3.18.2, TokenProxy.delete in restframework/authtoken/models.py uses the proxy's user-id pk while the concrete Token token-string primary key identifies rows, so Django issues a deletion query that matches no row and repor...

CVE-2026-114137

Django REST framework is a toolkit for building Web APIs. From 3.12.0 until 3.18.2, TokenProxy.delete in restframework/authtoken/models.py uses the proxy's user-id pk while the concrete Token token-string primary key identifies rows, so Django issues a deletion query that matches no row and repor...

PT-2026-120803

Name of the Vulnerable Software and Affected Versions Django REST framework versions 3.12.0 through 3.18.1 Description The TokenProxy.delete function in rest framework/authtoken/models.py incorrectly uses the proxy's user-id primary key instead of the concrete Token token-string primary key to...

Encode Django REST framework improper exception handling vulnerability

A security vulnerability exists in Django REST Framework versions 3.12.0 through 3.18.2. This vulnerability arises because TokenProxy.delete uses the user ID primary key of the proxy rather than the token string primary key of a specific token. As a result, deletion queries fail to match any rows...