CVE-2026-16764: OWASP DefectDojo API/Web serializers.py UserSerializer privileges management
A vulnerability was identified in OWASP DefectDojo 2.59.0. This issue affects the function UserSerializer of the file dojo/apiv2/serializers.py of the component API/Web. Such manipulation of the argument isstaff leads to improper privilege management. The attack may be performed from remote. The exploit is publicly available and might be used. Upgrading to version 2.58.3 and 3.0.0 is capable of addressing this issue. The name of the patch is 68a272f299d096249fd3ba9c2676bf69012857bf. It is advisable to upgrade the affected component. 2.59.0 was not intended to be released and has been removed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OWASP DefectDojo API/Webto a version that resolves this vulnerability.Fixed in 2.58.3Patch 68a272f299d096249fd3ba9c2676bf69012857bf - Upgrade
Upgrade
OWASP DefectDojo API/Webto a version that resolves this vulnerability.Fixed in 3.0.0Patch 68a272f299d096249fd3ba9c2676bf69012857bf
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16764?
The severity of CVE-2026-16764 is classified as medium with a score of 6.3.
How do I fix CVE-2026-16764?
To fix CVE-2026-16764, update OWASP DefectDojo to the latest version where this vulnerability has been addressed.
What component is affected by CVE-2026-16764?
CVE-2026-16764 affects the UserSerializer function within the dojo/api_v2/serializers.py file of the API/Web component.
What type of attack is possible with CVE-2026-16764?
CVE-2026-16764 allows for privilege escalation via improper management of the is_staff argument, which can be exploited remotely.
What does CVE-2026-16764 impact?
CVE-2026-16764 impacts user access controls within OWASP DefectDojo, leading to potential unauthorized access.