CVE-2026-73229

Affected versions of the Django REST framework package are vulnerable to Information Disclosure due to improper handling of invalid write requests by the `AdminRenderer`. The `AdminRenderer` temporarily overrides the request method to invoke the view's `GET` handler when rendering a 400 Bad Request response, which can include data intended to be protected by `GET` permissions. An attacker can exploit this by sending an invalid write request (e.g., a malformed `POST`) to a view configured with `AdminRenderer`, potentially exposing sensitive data in the HTML response that would otherwise be restricted by `GET` permissions.