AIKIDO-2026-10331
django-soft-delete is vulnerable to Improper Access Control
35
Low Risk
This Affects:
django-soft-deleteTL;DR
Affected versions of django_softdelete improperly handle filtering of soft-deleted objects in certain query and relation operations. Due to inconsistent enforcement of the soft-delete visibility logic, records marked as deleted may still be returned through specific ORM queries or related object lookups. An attacker or user could exploit this behavior to access objects that were intended to be hidden or deleted, potentially leading to unauthorized access to application data. The issue is resolved by ensuring soft-deleted records are consistently excluded from query results unless explicitly requested.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
django-soft-delete is vulnerable to Improper Access Control in versions 0.0.1 - 1.0.22.
How to fix this
Upgrade the django-soft-delete library to the patch version.
Get Secure Now
Secure your code, cloud, and runtime environments in one central system. Find and fix vulnerabilities automatically.
No credit card required | Scan results in 32secs.
SOC 2Compliant
ISO 27001Compliant