CVE-2026-16209

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-16209

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-16209.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-16209

Published

2026-07-19T03:00:11Z

Modified

2026-08-12T03:51:44Z

Severity

5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

Gerapy Project Upload Endpoint views.py missing authentication

Details

A vulnerability has been found in Gerapy up to 0.9.13. The impacted element is an unknown function of the file gerapy/server/core/views.py of the component Project Upload Endpoint. Such manipulation leads to missing authentication. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is bd4891c60315f17611a3b7a651ffe0fba7cfe71e. Applying a patch is advised to resolve this issue.

Database specific

{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-287",
        "CWE-306"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/16xxx/CVE-2026-16209.json"
}

References

Affected packages

Git / github.com/gerapy/gerapy

Affected ranges

Type

GIT

Repo

https://github.com/gerapy/gerapy

Events

Introduced

35180ca428370672fdb3404134bd1aeae7ec6c0a

Fixed

bd4891c60315f17611a3b7a651ffe0fba7cfe71e

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0.9.0"
        },
        {
            "last_affected": "0.9.0"
        },
        {
            "introduced": "0.9.1"
        },
        {
            "last_affected": "0.9.1"
        },
        {
            "introduced": "0.9.2"
        },
        {
            "last_affected": "0.9.2"
        },
        {
            "introduced": "0.9.3"
        },
        {
            "last_affected": "0.9.3"
        },
        {
            "introduced": "0.9.4"
        },
        {
            "last_affected": "0.9.4"
        },
        {
            "introduced": "0.9.5"
        },
        {
            "last_affected": "0.9.5"
        },
        {
            "introduced": "0.9.6"
        },
        {
            "last_affected": "0.9.6"
        },
        {
            "introduced": "0.9.7"
        },
        {
            "last_affected": "0.9.7"
        },
        {
            "introduced": "0.9.8"
        },
        {
            "last_affected": "0.9.8"
        },
        {
            "introduced": "0.9.9"
        },
        {
            "last_affected": "0.9.9"
        },
        {
            "introduced": "0.9.10"
        },
        {
            "last_affected": "0.9.10"
        },
        {
            "introduced": "0.9.11"
        },
        {
            "last_affected": "0.9.11"
        },
        {
            "introduced": "0.9.12"
        },
        {
            "last_affected": "0.9.12"
        },
        {
            "introduced": "0.9.13"
        },
        {
            "last_affected": "0.9.13"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*

0.9.0

0.9.1

0.9.10

0.9.11

0.9.12

0.9.13

0.9.2

0.9.3

0.9.4

0.9.5

0.9.6

0.9.7

0.9.8

0.9.9

v0.*

v0.9.0

v0.9.1

v0.9.10

v0.9.10rc1

v0.9.11

v0.9.12

v0.9.13

v0.9.2

v0.9.2rc1

v0.9.3

v0.9.3a1

v0.9.3a2

v0.9.3b1

v0.9.4

v0.9.5

v0.9.6

v0.9.6a1

v0.9.7

v0.9.8

v0.9.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-16209.json"