CVE-2026-16764

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-16764
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-16764.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-16764
Aliases
  • GHSA-w2j3-x3j3-mm43
Published
2026-07-23T21:30:11.529Z
Modified
2026-07-27T03:56:20.252585418Z
Severity
  • 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
OWASP DefectDojo API/Web serializers.py UserSerializer privileges management
Details

A vulnerability was identified in OWASP DefectDojo 2.59.0. This issue affects the function UserSerializer of the file dojo/apiv2/serializers.py of the component API/Web. Such manipulation of the argument isstaff leads to improper privilege management. The attack may be performed from remote. The exploit is publicly available and might be used. Upgrading to version 2.58.3 and 3.0.0 is capable of addressing this issue. The name of the patch is 68a272f299d096249fd3ba9c2676bf69012857bf. It is advisable to upgrade the affected component. 2.59.0 was not intended to be released and has been removed.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/16xxx/CVE-2026-16764.json",
    "cwe_ids": [
        "CWE-266",
        "CWE-269"
    ],
    "cna_assigner": "VulDB",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "2.59.0"
                },
                {
                    "last_affected": "2.59.0"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/defectdojo/django-defectdojo

Affected ranges

Type
GIT
Repo
https://github.com/defectdojo/django-defectdojo
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
68a272f299d096249fd3ba9c2676bf69012857bf
Fixed
b10ecf85571c45960c78d29a6b79adedbe308a2d
Database specific 
{
    "source": "REFERENCES"
}

Affected versions

1.*
1.1.0
1.1.1
1.1.2
1.1.3
1.2
1.2.0
1.2.1
1.2.2
1.2.5
1.2.6
1.2.7
1.2.8
1.5.4rc6
2.*
2.11.0
2.12.0
2.13.0
2.13.1
2.14.0
2.14.1
2.14.2
2.14.3
2.15.0
2.15.1
2.16.0
2.16.1
2.16.2
2.17.0
2.18.0
2.18.1
2.18.2
2.18.3
2.18.4
2.19.0
2.19.1
2.19.2
2.19.3
2.19.4
2.20.0
2.20.1
2.20.2
2.20.3
2.21.0
2.21.1
2.21.2
2.22.0
2.22.1
2.22.2
2.22.3
2.22.4
2.23.0
2.23.1
2.23.2
2.23.3
2.24.0
2.24.1
2.24.2
2.24.3
2.24.4
2.25.0
2.25.1
2.25.2
2.25.3
2.25.4
2.26.0
2.26.1
2.26.2
2.26.3
2.26.4
2.27.0
2.27.1
2.27.2
2.27.3
2.27.4
2.28.0
2.28.1
2.28.2
2.28.3
2.29.0
2.29.1
2.29.2
2.29.3
2.29.4
2.30.0
2.30.1
2.30.2
2.30.3
2.30.4
2.31.0
2.31.1
2.31.2
2.31.3
2.31.4
2.31.5
2.32.0
2.32.1
2.32.2
2.32.3
2.33.0
2.33.1
2.33.2
2.33.3
2.33.4
2.33.5
2.33.6
2.33.7
2.34.0
2.34.1
2.34.2
2.34.3
2.34.4
2.34.5
2.35.0
2.35.1
2.35.2
2.35.3
2.35.4
2.36.0
2.36.1
2.36.2
2.36.3
2.36.4
2.36.5
2.36.6
2.37.1
2.37.2
2.37.3
2.38.0
2.38.1
2.38.2
2.38.3
2.38.4
2.39.0
2.39.1
2.39.2
2.39.3
2.39.4
2.40.0
2.40.1
2.40.2
2.40.3
2.41.0
2.41.1
2.41.2
2.41.3
2.41.4
2.42.0
2.42.1
2.42.2
2.42.3
2.43.0
2.43.1
2.43.2
2.43.3
2.43.4
2.44.0
2.44.1
2.44.2
2.44.3
2.44.4
2.45.0
2.45.1
2.45.2
2.45.3
2.46.0
2.46.1
2.46.2
2.46.3
2.46.4
2.47.0
2.47.1
2.47.2
2.47.3
2.47.4
2.48.0
2.48.1
2.48.2
2.48.3
2.48.4
2.48.5
2.49.0
2.49.1
2.49.2
2.49.3
2.50.0
2.50.1
2.50.2
2.50.3
2.50.4
2.51.0
2.51.1
2.51.2
2.51.3
2.52.0
2.52.1
2.52.2
2.52.3
2.53.0
2.53.1
2.53.2
2.53.3
2.53.4
2.53.5
2.54.0
2.54.1
2.54.2
2.54.3
2.55.0
2.55.1
2.55.2
2.55.3
2.55.4
2.56.0
2.56.1
2.56.2
2.56.3
2.56.4
2.57.0
2.57.1
2.57.2
2.57.3
2.58.0
2.58.1
2.58.2
2.58.3
2.58.4
Other
python3
v1.*
v1.0.1
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v1.2
v1.2.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-16764.json"