CVE-2026-7510
OWAP DefectDojo Benchmark/Engagement/Product/Survey authorization
CVSS Score
6.3
EPSS Score
0.0%
EPSS Percentile
0th
A vulnerability was determined in OWAP DefectDojo up to 2.55.4. Affected by this vulnerability is an unknown functionality of the component Benchmark/Engagement/Product/Survey. Executing a manipulation can lead to authorization bypass. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.56.0 addresses this issue. This patch is called eb6120a379185d37eb1af17b69bb5614a830ab1f. Upgrading the affected component is recommended.
| CWE | CWE-639 CWE-285 |
| Vendor | owap |
| Product | defectdojo |
| Published | Apr 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for owap defectdojo
Be the first to know when new medium vulnerabilities affecting owap defectdojo are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
OWAP / DefectDojo
2.55.0 2.55.1 2.55.2 2.55.3 2.55.4
References
vuldb.com: https://vuldb.com/vuln/360317 vuldb.com: https://vuldb.com/vuln/360317/cti vuldb.com: https://vuldb.com/submit/803751 github.com: https://github.com/noname1337h1/cve-bug-bounty/blob/main/dfdj_risk_acceptance_raid_idor_authorization_bypass/dfdj_risk_acceptance_raid_idor_authorization_bypass.md github.com: https://github.com/DefectDojo/django-DefectDojo/pull/14375 github.com: https://github.com/DefectDojo/django-DefectDojo/commit/eb6120a379185d37eb1af17b69bb5614a830ab1f github.com: https://github.com/DefectDojo/django-DefectDojo/releases/tag/2.56.0
Credits
🔍 noname1337 (VulDB User)