CVE-2026-16764
OWASP DefectDojo API/Web serializers.py UserSerializer privileges management
CVSS Score
6.3
EPSS Score
0.0%
EPSS Percentile
0th
A vulnerability was identified in OWASP DefectDojo 2.59.0. This issue affects the function UserSerializer of the file dojo/api_v2/serializers.py of the component API/Web. Such manipulation of the argument is_staff leads to improper privilege management. The attack may be performed from remote. The exploit is publicly available and might be used. Upgrading to version 2.58.3 and 3.0.0 is capable of addressing this issue. The name of the patch is 68a272f299d096249fd3ba9c2676bf69012857bf. It is advisable to upgrade the affected component. 2.59.0 was not intended to be released and has been removed.
| CWE | CWE-269 CWE-266 |
| Vendor | owasp |
| Product | defectdojo |
| Published | Jul 23, 2026 |
Stay Ahead of the Next One
Get instant alerts for owasp defectdojo
Be the first to know when new medium vulnerabilities affecting owasp defectdojo are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
OWASP / DefectDojo
2.59.0
References
vuldb.com: https://vuldb.com/vuln/382629 vuldb.com: https://vuldb.com/vuln/382629/cti vuldb.com: https://vuldb.com/cve/CVE-2026-16764 vuldb.com: https://vuldb.com/submit/861317 github.com: https://github.com/DefectDojo/django-DefectDojo/security/advisories/GHSA-w2j3-x3j3-mm43 github.com: https://github.com/DefectDojo/django-DefectDojo/pull/14952 github.com: https://github.com/DefectDojo/django-DefectDojo/commit/68a272f299d096249fd3ba9c2676bf69012857bf github.com: https://github.com/DefectDojo/django-DefectDojo/releases/tag/3.0.0
Credits
🔍 0xnosferatu (VulDB User) VulDB CNA Team