# CVE-2026-16214: geex-arts django-jet authorization bypass in Dashboard Module

Source: https://junglewise.ai/threats/cve-2026-16214-geex-arts-django-jet-authorization-bypass-in-dashboard-module  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-19. Updated: 2026-07-19  
License: CC BY 4.0 with a link back

CVE-2026-16214 · Severity: medium · CVSS 6.3 · Published 2026-07-19

django-jet, a popular administrative interface template for the Django web framework, contains security flaws in its Dashboard Module. These flaws allow staff members to view or modify dashboard configurations belonging to other users by simply changing a numeric ID in the web address. Additionally, certain features for Google Analytics and Yandex Metrika can be manipulated to disconnect services or link a victim's data to an attacker's dashboard, potentially leading to unauthorized data access or service disruption within the management console.

Technologies: [GEEX-ARTS JET](https://junglewise.ai/threats/technologies/jet). Vendors: [GEEX-ARTS](https://junglewise.ai/threats/vendors/geex-arts).

## Quick answers

**Is CVE-2026-16214 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16214 being exploited in the wild.

**How severe is CVE-2026-16214?** Medium severity, with a CVSS score of 6.3, published 19 July 2026.

**Which products and versions are affected?** GEEX-ARTS JET up to 1.0.8.

**Is there a fix for CVE-2026-16214?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-16214 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-16214?** Check whether you run GEEX-ARTS JET at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability encompasses three distinct authorization issues within the Dashboard Module of django-jet (up to 1.0.8). First, an Insecure Direct Object Reference (IDOR) in `jet/dashboard/views.py` allows any user with 'is_staff' permissions to access or modify dashboard modules of other staff users because the application fails to scope object lookups to the owner. Second, the Google Analytics and Yandex Metrika credential revoke endpoints lack authentication and ownership checks, allowing remote attackers to delete credentials via a simple GET request. Third, the OAuth flow for these modules uses the module's primary key as the 'state' parameter rather than a secure nonce, enabling an attacker to bind a victim's third-party authorization token to an attacker-controlled dashboard module. As of the advisory date, no official patch has been released by the vendor.

## Affected products

- geex-arts django-jet up to 1.0.8

## Timeline

- 2026-06-13: disclosed: Issue reported to vendor via GitHub issue #528
- 2026-07-19: advisory: CVE-2026-16214 published

## References

- [https://github.com/geex-arts/django-jet/](https://github.com/geex-arts/django-jet/)
- [https://github.com/geex-arts/django-jet/issues/528](https://github.com/geex-arts/django-jet/issues/528)
- [https://vuldb.com/cve/CVE-2026-16214](https://vuldb.com/cve/CVE-2026-16214)
- [https://vuldb.com/submit/857945](https://vuldb.com/submit/857945)
- [https://vuldb.com/vuln/380037](https://vuldb.com/vuln/380037)
- [https://vuldb.com/vuln/380037/cti](https://vuldb.com/vuln/380037/cti)

## Related threats

- [geex-arts django-jet CSRF and auth bypass in OAuth Handler](https://junglewise.ai/threats/cve-2026-16216-geex-arts-django-jet-csrf-and-auth-bypass-in-oauth-handler)
- [geex-arts django-jet missing authorization in OAuth and dashboard modules](https://junglewise.ai/threats/cve-2026-16215-geex-arts-django-jet-missing-authorization-in-oauth-and-dashboard)