User Impersonation Affecting django-tenant-users package, versions [,2.1.0)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-DJANGOTENANTUSERS-10734131
- published14 Jul 2025
- disclosed1 Mar 2025
- creditLouis LALBA
Introduced: 1 Mar 2025
CVE NOT AVAILABLE CWE-290 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade django-tenant-users to version 2.1.0 or higher.
Overview
django-tenant-users is an A Django app to extend django-tenants to incorporate global multi-tenant users
Affected versions of this package are vulnerable to User Impersonation via custom schema name in provision_tenant() function. An attacker can creates a tenant with is_staff, is_superuser, is_verified or email as a schema name that matches an existing User attribute and impersonate a user if an application relies on these attributes for authorization or business logic.