CVEvulnerability

CVE-2025-48383

8.2 HIGH Published 2025-05-27 Modified 2026-06-17 Official page ↗

Status: Deferred
Published: 2025-05-27
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 8.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Weaknesses: CWE-402, CWE-918

Description

Django-Select2 is a Django integration for Select2. Prior to version 8.4.1, instances of HeavySelect2Mixin subclasses like the ModelSelect2MultipleWidget and ModelSelect2Widget can leak secret access tokens across requests. This can allow users to access restricted query sets and restricted data. This issue has been patched in version 8.4.1.

Weakness · CWE (2)

CWE-402 Transmission of Private Resources into a New Sphere weakness
CWE-918 Server-Side Request Forgery weakness

References

https://github.com/codingjoe/django-select2/commit/e5f41e6edba004d35f94915ff5e2559f44853412 github.com
https://github.com/codingjoe/django-select2/security/advisories/GHSA-wjrh-hj83-3wh7 github.com

CVE-2025-48383

Description

Related

Weakness · CWE (2)

References