The vulnerability of the Django web application software platform allows attackers to circumvent existing access restrictions.

The vulnerability of the Django web application framework exists due to incorrect installations of the saveas parameter in the ModelAdmin class. Exploiting this vulnerability allows a malicious actor to circumvent existing access restrictions from a remote perspective...

python-django: permission bypass

If a ModelAdmin uses saveas=True not the default, the admin provides an option when editing objects to "Save as new". A regression in Django 1.9 prevented that form submission from raising a "Permission Denied" error for users without the "add" permission...

django -- regression in permissions model

Tim Graham reports: User with "change" but not "add" permission can create objects for ModelAdmin’s with saveas=True...