Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
NVD Vulnerability Details :
CVE-2026-16764
Received
More InfoOfficial Page
Source-cna@vuldb.com
View Known Exploited Vulnerability (KEV) details
Published At-23 Jul, 2026 | 22:16
Updated At-23 Jul, 2026 | 22:16

A vulnerability was identified in OWASP DefectDojo 2.59.0. This issue affects the function UserSerializer of the file dojo/api_v2/serializers.py of the component API/Web. Such manipulation of the argument is_staff leads to improper privilege management. The attack may be performed from remote. The exploit is publicly available and might be used. Upgrading to version 2.58.3 and 3.0.0 is capable of addressing this issue. The name of the patch is 68a272f299d096249fd3ba9c2676bf69012857bf. It is advisable to upgrade the affected component. 2.59.0 was not intended to be released and has been removed.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary4.02.1LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary3.16.3MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Secondary2.06.5MEDIUM
AV:N/AC:L/Au:S/C:P/I:P/A:P
Type: Secondary
Version: 4.0
Base score: 2.1
Base severity: LOW
Vector:
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Type: Primary
Version: 3.1
Base score: 6.3
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Type: Secondary
Version: 2.0
Base score: 6.5
Base severity: MEDIUM
Vector:
AV:N/AC:L/Au:S/C:P/I:P/A:P
CPE Matches

Weaknesses
CWE IDTypeSource
CWE-266Primarycna@vuldb.com
CWE-269Primarycna@vuldb.com
CWE ID: CWE-266
Type: Primary
Source: cna@vuldb.com
CWE ID: CWE-269
Type: Primary
Source: cna@vuldb.com
Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References
HyperlinkSourceResource
https://github.com/DefectDojo/django-DefectDojo/commit/68a272f299d096249fd3ba9c2676bf69012857bfcna@vuldb.com
N/A
https://github.com/DefectDojo/django-DefectDojo/pull/14952cna@vuldb.com
N/A
https://github.com/DefectDojo/django-DefectDojo/releases/tag/3.0.0cna@vuldb.com
N/A
https://github.com/DefectDojo/django-DefectDojo/security/advisories/GHSA-w2j3-x3j3-mm43cna@vuldb.com
N/A
https://vuldb.com/cve/CVE-2026-16764cna@vuldb.com
N/A
https://vuldb.com/submit/861317cna@vuldb.com
N/A
https://vuldb.com/vuln/382629cna@vuldb.com
N/A
https://vuldb.com/vuln/382629/cticna@vuldb.com
N/A
Hyperlink: https://github.com/DefectDojo/django-DefectDojo/commit/68a272f299d096249fd3ba9c2676bf69012857bf
Source: cna@vuldb.com
Resource: N/A
Hyperlink: https://github.com/DefectDojo/django-DefectDojo/pull/14952
Source: cna@vuldb.com
Resource: N/A
Hyperlink: https://github.com/DefectDojo/django-DefectDojo/releases/tag/3.0.0
Source: cna@vuldb.com
Resource: N/A
Hyperlink: https://github.com/DefectDojo/django-DefectDojo/security/advisories/GHSA-w2j3-x3j3-mm43
Source: cna@vuldb.com
Resource: N/A
Hyperlink: https://vuldb.com/cve/CVE-2026-16764
Source: cna@vuldb.com
Resource: N/A
Hyperlink: https://vuldb.com/submit/861317
Source: cna@vuldb.com
Resource: N/A
Hyperlink: https://vuldb.com/vuln/382629
Source: cna@vuldb.com
Resource: N/A
Hyperlink: https://vuldb.com/vuln/382629/cti
Source: cna@vuldb.com
Resource: N/A
Change History
0Changes found

Details not found