Hi Chris, On Tue, Nov 03, 2026 at 01:55:53PM -0800, Chris Lamb wrote: > Salvatore Bonaccorso wrote: > > >> - CVE-2026-113733: Fix a password hash disclosure to "view only" admin > >> users with custom user models. Admin users with the 'view' (but not > >> 'change') permission to a user model were shown the entire password > >> hash > >> when the model was not AUTH_USER_MODEL (or when AUTH_USER_MODEL > >> inherited > >> its password field from a concrete parent model through multi-table > >> inheritance). > > > > This should be only from 6.0 onwards, is this correct? > > Yes, you are correct. I misparsed the issue due to the way it is phrasded ??? > prior > to Django 6.0, the admin does no obfuscation of the hash (which is not ideal, > but > a trivial issue). It is therefore not vulnerable in trixie either of course. > (I > haven't checked the other CVEs yet.) > > The changelog uploaded to sid is therefore misleading. I can fix that in a > future > upload, but shall I split this bug into two so you can track this more > precisely > in the BTS, or is marking it as such in the security tracker enough?
Thanks a lot for the confirmation. No no need to split up the bug, we should have all in order from security-tracker point of view now and it fine. We will followup to your question shortly about the update in trixie. Regards, Salvatore
