CVE-2026-16764 in DefectDojo
Summary
by MITRE • 07/24/2026
A vulnerability was identified in OWASP DefectDojo 2.59.0. This issue affects the function UserSerializer of the file dojo/api_v2/serializers.py of the component API/Web. Such manipulation of the argument is_staff leads to improper privilege management. The attack may be performed from remote. The exploit is publicly available and might be used. Upgrading to version 2.58.3 and 3.0.0 is capable of addressing this issue. The name of the patch is 68a272f299d096249fd3ba9c2676bf69012857bf. It is advisable to upgrade the affected component. 2.59.0 was not intended to be released and has been removed.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/24/2026
The vulnerability in OWASP DefectDojo version 2.59.0 represents a critical improper privilege management flaw within the API/Web component, specifically affecting the UserSerializer function located in dojo/api_v2/serializers.py. This issue stems from insufficient validation of the is_staff argument parameter, which allows unauthorized manipulation of user privileges through the application programming interface. The vulnerability exists at the serialization layer where user data is processed and transmitted, creating a potential pathway for privilege escalation attacks.
The technical exploitation of this vulnerability occurs through remote manipulation of the is_staff parameter during user data serialization processes. Attackers can leverage this flaw to elevate their privileges or grant administrative access to unauthorized users by crafting malicious API requests that modify the staff status field. This represents a direct violation of the principle of least privilege and demonstrates weak input validation mechanisms within the application's API layer. The vulnerability has been classified as having a publicly available exploit, which significantly increases the risk surface and makes it immediately actionable by threat actors.
The operational impact of this vulnerability extends beyond simple privilege escalation to encompass potential full system compromise. When an attacker successfully manipulates the is_staff parameter, they gain administrative capabilities within the DefectDojo environment, potentially enabling them to access sensitive security data, modify test results, alter user permissions, or even exfiltrate confidential information from the vulnerability management platform. The affected component operates at the API level, making it particularly dangerous as it can be exploited through automated tools and does not require physical access to the system infrastructure.
Security mitigations for this vulnerability primarily involve immediate upgrading to version 2.58.3 or 3.0.0, which contain the patch identified by commit hash 68a272f299d096249fd3ba9c2676bf69012857bf. This remediation addresses the root cause through proper input validation and privilege management controls within the UserSerializer implementation. Organizations should also implement network-level restrictions to limit API access, monitor for anomalous privilege modification attempts, and conduct thorough security assessments of their DefectDojo deployments. The vulnerability aligns with CWE-284 (Improper Access Control) and may be exploited using techniques from the privilege escalation category within the ATT&CK framework, specifically targeting the 'Abuse Elevation of Privilege' tactic.
The discontinuation of version 2.59.0 represents a proactive security measure acknowledging the severity of this flaw, as the release was never intended for production deployment due to its critical nature. Organizations should perform comprehensive inventory checks to ensure all instances of DefectDojo are updated and verify that no systems remain running the vulnerable version. Additional defensive measures include implementing automated patch management processes and establishing monitoring protocols specifically designed to detect unauthorized privilege modifications within security tools and vulnerability management platforms.