A vulnerability was identified in OWASP DefectDojo 2.59.0. This issue affects the function UserSerializer of the file dojo/api_v2/serializers.py of the component API/Web. Such manipulation of the argument is_staff leads to improper privilege management.
The attack may be performed from remote. The exploit is publicly available and might be used. Upgrading to version 2.58.3 and 3.0.0 is capable of addressing this issue.
The name of the patch is 68a272f299d096249fd3ba9c2676bf69012857bf. It is advisable to upgrade the affected component. 2.59.0 was not intended to be released and has been removed.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
Low
Partial data modification
Availability
Low
Partial disruption
CVSS Vector v4.0
Weakness Type (CWE)
References 8
https://github.com/DefectDojo/django-DefectDojo/commit/68a272f299d096249fd3ba9c…
cna@vuldb.com
https://github.com/DefectDojo/django-DefectDojo/pull/14952
cna@vuldb.com
https://github.com/DefectDojo/django-DefectDojo/releases/tag/3.0.0
cna@vuldb.com
https://github.com/DefectDojo/django-DefectDojo/security/advisories/GHSA-w2j3-x…
cna@vuldb.com
https://vuldb.com/cve/CVE-2026-16764
cna@vuldb.com
https://vuldb.com/submit/861317
cna@vuldb.com
https://vuldb.com/vuln/382629
cna@vuldb.com
https://vuldb.com/vuln/382629/cti
cna@vuldb.com