PT-2026-64184

CVE-2026-16764

Published

2026-07-23

Updated

2026-09-25

Description by

CVSS 2.0

6.5

Medium

MetricsAV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OWASP DefectDojo version 2.59.0

Description Improper privilege management occurs in the API/Web component within the UserSerializer() function located in the dojo/api v2/serializers.py file. A remote attacker can manipulate the is staff argument to gain unauthorized privileges.

Recommendations Upgrade to version 2.58.3 or 3.0.0.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-269: Improper Privilege Management

CWE-266: Incorrect Privilege Assignment

Related identifiers