What is CVE-2026-16764?

CVE-2026-16764 is a medium-severity vulnerability in Owasp Defectdojo, classified under Incorrect Privilege Assignment. CVSS score: 6.3/10. Published 2026-07-23.

How severe is CVE-2026-16764?

Medium severity. CVSS v3 base score is 6.3 out of 10.

Privilege escalation in Owasp Defectdojo

CVE-2026-16764

A vulnerability was identified in OWASP DefectDojo 2.59.0. This issue affects the function UserSerializer of the file dojo/api_v2/serializers.py of the component API/Web. Such manipulation of the argument is_staff leads to improper privile…

CVSS v3 metric

CVSS v3 base score 6.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.

Affected products

Owasp Defectdojo — versions 2.59.0, 2.58.3, 3.0.0

Weakness classification (CWE)

References

cna@vuldb.com (technical-description, vdb-entry)
cna@vuldb.com (signature, permissions-required)
cna@vuldb.com (third-party-advisory)
cna@vuldb.com (third-party-advisory)
cna@vuldb.com (related)
cna@vuldb.com (issue-tracking, patch)
cna@vuldb.com (patch)
cna@vuldb.com (patch)

Frequently asked questions

What is CVE-2026-16764?: CVE-2026-16764 is a medium-severity vulnerability in Owasp Defectdojo, classified under Incorrect Privilege Assignment. CVSS score: 6.3/10. Published 2026-07-23.
How severe is CVE-2026-16764?: Medium severity. CVSS v3 base score is 6.3 out of 10.