EUVD-2026-45425
GHSA-9jhf-c7f3-44h2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-exploitable IDOR requiring low-privilege Django session; bounded low CIA reflects dashboard-scoped unauthorized access without system-level compromise or scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was identified in geex-arts django-jet up to 1.0.8. This affects an unknown function of the file jet/dashboard/views.py of the component Dashboard Module. Such manipulation leads to authorization bypass. The attack can be executed remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Authorization bypass in geex-arts django-jet up to version 1.0.8 allows remote low-privilege authenticated users to circumvent object-level access controls in the Dashboard Module's jet/dashboard/views.py via user-controlled key manipulation (CWE-639). An attacker with a valid Django session can substitute controlled identifiers in dashboard requests to access or modify resources belonging to other users beyond their intended authorization scope. A public proof-of-concept is available via GitHub issue #528, and no patch has been released - the project maintainer has not responded to the disclosure, leaving all users on affected versions permanently exposed.
Technical ContextAI
django-jet (cpe:2.3:a:geex-arts:django-jet) is a third-party Django admin interface enhancement library providing a modern UI and modular dashboard widget system. The vulnerable component is the Dashboard Module implemented in jet/dashboard/views.py. CWE-639 (Authorization Bypass Through User-Controlled Key) identifies the root cause as a classic Insecure Direct Object Reference (IDOR) pattern: the application accepts a user-supplied identifier - such as a widget ID, dashboard object key, or module reference - and retrieves or operates on the corresponding server-side resource without verifying that the requesting user is authorized to access that specific object. The Django framework itself provides object-level permission hooks, but the vulnerable views appear to skip this check, relying solely on session-level authentication rather than per-object ownership validation.
RemediationAI
No vendor-released patch has been identified at time of analysis; the project has not responded to the disclosure and shows signs of abandonment. The primary recommended remediation is migration to an actively maintained Django admin alternative such as django-jazzmin, Unfold, or django-baton, which eliminates the vulnerability entirely though it requires UI migration effort. As immediate compensating controls, restrict network access to the Django admin and dashboard interface to trusted IP ranges or a VPN, reducing the pool of users who can reach the vulnerable endpoint - note this does not eliminate risk for insiders or compromised accounts within the allowed range. Enforce strict Django admin account hygiene by auditing which users hold staff or superuser status and revoking unnecessary access, since PR:L means any low-privilege Django user can attempt exploitation. Implement server-side logging and alerting on anomalous dashboard API calls (unexpected object ID sequences, cross-user patterns) to detect active exploitation. Disabling the django-jet dashboard widget system entirely, if the feature is not business-critical, removes the vulnerable code path without requiring an application rewrite.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today