Executive brief
OWASP DefectDojo, a popular open-source vulnerability management tool, was found to have a flaw in its user management system. An attacker with low-level access could manipulate their account settings to gain administrative privileges. This could allow an unauthorized user to access sensitive security data, modify system configurations, or disrupt vulnerability management operations.
Technical details
An improper privilege management vulnerability exists in OWASP DefectDojo version 2.59.0 within the 'UserSerializer' function of 'dojo/api_v2/serializers.py'. The root cause is the lack of restriction on the 'is_staff' argument, which allows a remote authenticated user with low-level permissions to elevate their own privileges. By manipulating this argument via the API, an attacker can gain staff-level access to the application. The vendor has stated that version 2.59.0 was an accidental release and has been withdrawn; users should upgrade to version 2.58.3 or 3.0.0, which include a patch that restricts 'is_staff' modifications to superusers only.
Affected products
- OWASP DefectDojo 2.59.0
Timeline
- 2026-06-04: patched: Patch 68a272f committed to repository
- 2026-07-23: disclosed: CVE-2026-16764 published
References
- https://github.com/DefectDojo/django-DefectDojo/commit/68a272f299d096249fd3ba9c2676bf69012857bf
- https://github.com/DefectDojo/django-DefectDojo/pull/14952
- https://github.com/DefectDojo/django-DefectDojo/releases/tag/3.0.0
- https://github.com/DefectDojo/django-DefectDojo/security/advisories/GHSA-w2j3-x3j3-mm43
- https://vuldb.com/cve/CVE-2026-16764
- https://vuldb.com/submit/861317
- https://vuldb.com/vuln/382629