Language: Python
Label: safe
CWE: CWE-521 \u2014 Weak Password Requirements
The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.

Code:
    def test_regular_user_cant_add_users(self):
        response = self.client.get("/admin/auth/user/add/")
        self.assertEqual(HTTPStatus.FORBIDDEN, response.status_code)

        response = self.client.post(
            "/admin/auth/user/add/",
            {
                "username": "added-by-regular-user",
                "password1": __FOR_TESTING__,
                "password2": __FOR_TESTING__,
            },
            follow=True,
        )
        self.assertEqual(HTTPStatus.FORBIDDEN, response.status_code)
        self.assertFalse(
            get_user_model().objects.filter(username="added-by-regular-user").exists()
        )