[GHSA] GHSA-g47c-3xmw-q6m2 (medium) — Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests

GHSA-g47c-3xmw-q6m2 Severity: medium CVE: CVE-2026-73229

Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests

Summary

AdminRenderer may disclose data that would normally be protected by GET permissions when rendering a 400 Bad Request response for an invalid write request.

If a view allows POST (or another write method) but denies GET, an i