EUVD-2026-48439
GHSA-43fx-4mqw-qphw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network API access with low-privilege auth required; scope changes because is_staff enables Django admin, yielding high confidentiality and integrity impact over DefectDojo's full dataset.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was identified in OWASP DefectDojo 2.59.0. This issue affects the function UserSerializer of the file dojo/api_v2/serializers.py of the component API/Web. Such manipulation of the argument is_staff leads to improper privilege management. The attack may be performed from remote. The exploit is publicly available and might be used. Upgrading to version 2.58.3 and 3.0.0 is capable of addressing this issue. The name of the patch is 68a272f299d096249fd3ba9c2676bf69012857bf. It is advisable to upgrade the affected component. 2.59.0 was not intended to be released and has been removed.
Articles & Coverage 1
AnalysisAI
Privilege escalation in OWASP DefectDojo 2.59.0 exposes authenticated non-superusers to flip the is_staff flag on any account - including their own - through the UserSerializer in the v2 API, bypassing DefectDojo's role-based access controls and granting Django admin access. Version 2.59.0 was an accidental release and has been pulled; patched releases 2.58.3 and 3.0.0 exist. Publicly available exploit code is acknowledged (CVSS 4.0 E:P), and no special preconditions beyond a valid authenticated session with delegated user-management permissions are required.
Technical ContextAI
DefectDojo is a Django-based vulnerability management platform. The flaw resides in the validate() method of UserSerializer in dojo/api_v2/serializers.py. Prior to the fix, the serializer applied no guard on the is_staff field: any caller with sufficient API permission to update a user record could pass is_staff=true without the application verifying that the requestor was a superuser. CWE-269 (Improper Privilege Management) accurately characterises the root cause - is_staff in Django's auth model is a near-superuser flag: it grants access to the /admin/ site and, under Django's default UserAdmin, allows a holder with the change_user permission to tick is_superuser on themselves, completing a full privilege escalation chain. The patch (commit 68a272f, PR #14952) introduces an explicit check in validate() that rejects any is_staff mutation by non-superusers, restricts the admin site gate to require is_superuser (not merely is_staff), and defaults DD_DJANGO_ADMIN_ENABLED to False. The affected CPE is cpe:2.3:a:owasp:defectdojo:*:*:*:*:*:*:*:* scoped to version 2.59.0.
RemediationAI
Upgrade immediately to DefectDojo 2.58.3 (for the 2.x line) or 3.0.0 (for the 3.x line); both are confirmed patched releases per the vendor advisory at https://github.com/DefectDojo/django-DefectDojo/releases/tag/3.0.0 and the patch commit 68a272f299d096249fd3ba9c2676bf69012857bf. If an immediate upgrade is not feasible, disable the Django admin interface by setting DD_DJANGO_ADMIN_ENABLED=False (which is now the default in patched releases) - this removes the secondary escalation path from is_staff to is_superuser, though it does not prevent the API-level is_staff mutation itself. Additionally, audit all user accounts in the DefectDojo instance for unexpected is_staff or is_superuser flags and revoke them. Restrict the user-update API permissions to the smallest possible set of accounts. No side effects of upgrading have been documented by the vendor.
More in Defectdojo
View allSame weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today