{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/django-rest-framework/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:django_rest_framework:django_rest_framework:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.4,"id":"CVE-2026-114137"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Django REST framework (3.12.0 - 3.18.1)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","web-api","django"],"_cs_type":"advisory","_cs_vendors":["Django REST framework"],"content_html":"\u003cp\u003eDjango REST framework versions 3.12.0 to 3.18.1 contain a logic vulnerability in the \u003ccode\u003eTokenProxy.delete()\u003c/code\u003e method within \u003ccode\u003erest_framework/authtoken/models.py\u003c/code\u003e. The method incorrectly uses the user ID primary key instead of the token string primary key when executing database deletion queries. As a result, the query fails to locate the target record and reports zero deletions without triggering an error or exception.\u003c/p\u003e\n\u003cp\u003eAny application, administrative integration, or operational script relying on this method to revoke access will incorrectly process the operation as successful. Because Django REST framework tokens do not expire automatically, this vulnerability allows revoked or compromised tokens to remain active indefinitely, granting continued unauthorized access to APIs. This issue is fixed in version 3.18.2.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eAttackers can maintain persistent access to APIs despite administrator attempts to revoke their credentials. The silent failure prevents security monitoring tools or automated lifecycle management scripts from detecting that the token remains valid in the database.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Django REST framework to version 3.18.2 or later immediately.\u003c/li\u003e\n\u003cli\u003eAudit custom scripts, management commands, and administrative API integrations that perform token revocation to ensure they do not rely on \u003ccode\u003eTokenProxy.delete()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eFor affected systems, perform a database audit to identify orphaned or unintended active tokens that were mistakenly thought to be deleted by automated processes.\u003c/li\u003e\n\u003cli\u003eTransition to using explicit record deletion methods, such as \u003ccode\u003eToken.objects.filter(key=...).delete()\u003c/code\u003e, which correctly target the token string primary key.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-21T21:41:23Z","date_published":"2026-10-21T21:41:23Z","id":"https://feed.craftedsignal.io/briefs/2026-10-django-rest-token-revocation/","summary":"Django REST framework versions 3.12.0 through 3.18.1 contain a logic flaw where TokenProxy.delete() uses an incorrect primary key, causing credential revocation attempts to fail silently.","title":"Django REST framework: Token revocation failure (CVE-2026-114137)","url":"https://feed.craftedsignal.io/briefs/2026-10-django-rest-token-revocation/"}],"language":"en","title":"CraftedSignal Threat Feed - Django REST Framework","version":"https://jsonfeed.org/version/1.1"}