Hi Chris, On Tue, Nov 03, 2026 at 09:07:03PM +0000, Debian Bug Tracking System wrote: > python-django (3:5.2.19-1) unstable; urgency=high > . > * New upstream security release: [...] > - CVE-2026-113733: Fix a password hash disclosure to "view only" admin > users with custom user models. Admin users with the 'view' (but not > 'change') permission to a user model were shown the entire password > hash > when the model was not AUTH_USER_MODEL (or when AUTH_USER_MODEL > inherited > its password field from a concrete parent model through multi-table > inheritance).
This should be only from 6.0 onwards, is this correct? Regards, Salvatore
