CVE-2026-42864: Drf Allowany On Serializer Bound View

A Django REST Framework Create-style view (uses `CreateModelMixin`, `CreateAPIView`, or `ListCreateAPIView`) declares `permission_classes = [permissions.AllowAny]` while also defining a `serializer_class`, exposing a mutating/data-binding endpoint to anonymous callers. This is the unsafe pattern from CVE-2026-42864 (firefighter-incident `CreateJiraBotView`):

Provally CuratedPublic repositoryHighMedium confidenceVerifiedApache-2.0Python
greprules fetch cve-2026-42864-drf-allowany-on-serializer-bound-view --engine opengrep

Description

A Django REST Framework Create-style view (uses `CreateModelMixin`, `CreateAPIView`, or `ListCreateAPIView`) declares `permission_classes = [permissions.AllowAny]` while also defining a `serializer_class`, exposing a mutating/data-binding endpoint to anonymous callers. This is the unsafe pattern from CVE-2026-42864 (firefighter-incident `CreateJiraBotView`):