OWASP DefectDojo CVE-2026-16764

Exploitation requires an authenticated session in DefectDojo 2.59.0 with at least the auth.change_user and auth.add_user Django permissions - these are typically granted to delegated user-manager roles, not arbitrary end-users. The /admin/ interface must also be reachable (DD_DJANGO_ADMIN_ENABLED=True, which was the prior default). Limiting factors include: the attacker must already hold a DefectDojo account with delegated user-management permissions; the affected version (2.59.0) is a narrow, accidental release that has been pulled; and the secondary escalation path through Django admin requires the admin interface to be enabled and accessible. The attack is not exploitable by unauthenticated actors or by standard read-only DefectDojo users without change_user permission.

The CVSS 4.0 score of 5.3 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) reflects low impact ratings on vulnerable-system metrics, which appears conservative given the actual escalation potential: gaining is_staff gives Django admin access and, through a second step, a path to is_superuser. The E:P environmental modifier confirms public exploit code exists, elevating practical risk above the base score implies. There is no CISA KEV listing, so active mass exploitation has not been confirmed. The exposure window is narrow: 2.59.0 was an accidental release that has been removed from distribution, meaning only installations that proactively fetched that specific tag are affected. EPSS data was not provided; given the narrow affected version footprint and the authentication prerequisite (PR:L), opportunistic mass scanning is unlikely. The most credible threat actor is an insider or a compromised low-privilege service account within a DefectDojo instance, not an external unauthenticated attacker. Risk priority is moderate-high for any organisation running 2.59.0 but low for the broader DefectDojo user base.

An attacker with a valid DefectDojo account that holds delegated change_user and add_user permissions sends a PATCH request to /api/v2/users/{own_id}/ with the body {"is_staff": true}. Because UserSerializer applies no superuser check on that field, the flag is saved; the attacker then accesses the Django /admin/ interface, uses the UserAdmin change form to set is_superuser on their account, and from that point has unrestricted access to all vulnerability records, findings, and user data within DefectDojo. Public exploit code exists per the E:P CVSS 4.0 modifier.