Is CVE-2026-16215 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-16215 being exploited in the wild.

How severe is CVE-2026-16215?

Medium severity, with a CVSS score of 6.5, published 19 July 2026.

Is there a fix for CVE-2026-16215?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-16215 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-16215?

Check whether you run GEEX-ARTS JET at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-16215: geex-arts django-jet missing authorization in OAuth and dashboard modules

CVE-2026-16215 · Severity: medium · CVSS 6.5 · Published 2026-07-19

django-jet, a popular administrative interface template for Django websites, contains security flaws in its dashboard and OAuth components. These flaws allow unauthorized users to delete dashboard credentials or manipulate dashboard modules belonging to other staff members. In some cases, an attacker could trick a legitimate user into linking their Google or Yandex analytics data to the attacker's dashboard, leading to data exposure and service disruption.

Technologies: GEEX-ARTS JET. Vendors: GEEX-ARTS.

Quick answers

Is CVE-2026-16215 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-16215 being exploited in the wild.
How severe is CVE-2026-16215?: Medium severity, with a CVSS score of 6.5, published 19 July 2026.
Which products and versions are affected?: GEEX-ARTS JET up to 1.0.8.
Is there a fix for CVE-2026-16215?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-16215 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-16215?: Check whether you run GEEX-ARTS JET at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Multiple authorization vulnerabilities exist in django-jet up to 1.0.8. First, an Insecure Direct Object Reference (IDOR) in jet/dashboard/views.py allows staff users to access and modify dashboard modules of other users by manipulating the primary key (PK). Second, the OAuth credential revoke endpoints for Google Analytics and Yandex Metrika lack authentication and ownership checks, allowing remote unauthenticated attackers to delete credentials via a simple GET request. Third, the OAuth flow uses the module PK as the 'state' parameter without nonces, enabling an attacker to bind a victim's third-party OAuth token to an attacker-controlled dashboard module. As of the advisory date, no official patch has been released by the maintainers.

Affected products

geex-arts django-jet up to 1.0.8

Timeline

2026-06-13: disclosed: Issue reported to the project maintainers via GitHub issue #528
2026-07-19: advisory: CVE-2026-16215 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.