CVE-2026-115329: Python Drf Get Object Override Bypasses Get Queryset Scopingcve-2026-115329-python-drf-get-object-override-bypasses-get-queryset-scoping
get_object() in class $VIEW fetches the object with `self.queryset.get(...)` (the raw class-level queryset attribute) instead of `self.get_queryset()`. This bypasses the queryset hook where tenant/organization scoping and filter_queryset() are applied, and — because get_object() is overridden — DRF's default check_object_permissions() never runs. Any authent
