Executive brief
django-jet, a popular administrative interface template for Django websites, contains security flaws in its dashboard and OAuth components. These flaws allow unauthorized users to delete dashboard credentials or manipulate dashboard modules belonging to other staff members. In some cases, an attacker could trick a legitimate user into linking their Google or Yandex analytics data to the attacker's dashboard, leading to data exposure and service disruption.
Technical details
Multiple authorization vulnerabilities exist in django-jet up to 1.0.8. First, an Insecure Direct Object Reference (IDOR) in jet/dashboard/views.py allows staff users to access and modify dashboard modules of other users by manipulating the primary key (PK). Second, the OAuth credential revoke endpoints for Google Analytics and Yandex Metrika lack authentication and ownership checks, allowing remote unauthenticated attackers to delete credentials via a simple GET request. Third, the OAuth flow uses the module PK as the 'state' parameter without nonces, enabling an attacker to bind a victim's third-party OAuth token to an attacker-controlled dashboard module. As of the advisory date, no official patch has been released by the maintainers.
Affected products
- geex-arts django-jet up to 1.0.8
Timeline
- 2026-06-13: disclosed: Issue reported to the project maintainers via GitHub issue #528
- 2026-07-19: advisory: CVE-2026-16215 published