CVE-2026-42864: Drf Allowany On Serializer Bound Viewcve-2026-42864-drf-allowany-on-serializer-bound-view
A Django REST Framework Create-style view (uses `CreateModelMixin`, `CreateAPIView`, or `ListCreateAPIView`) declares `permission_classes = [permissions.AllowAny]` while also defining a `serializer_class`, exposing a mutating/data-binding endpoint to anonymous callers. This is the unsafe pattern from CVE-2026-42864 (firefighter-incident `CreateJiraBotView`):
