/
← Voltar ao feed
high

CVE-2026-16764: OWASP DefectDojo REST API flaw lets low-privilege users escalate to superuser via is_staff

1 fonte(s) · 1 atualização(ões) · publicado 25/09/2026 17:03 · coletado há 1 dia

A privilege escalation flaw, CVE-2026-16764 (GHSA-w2j3-x3j3-mm43, CVSS 3.1 7.8, CWE-269), affects OWASP DefectDojo. The REST API UserSerializer validates changes to is_superuser but not to is_staff. An authenticated user holding only the delegated auth.change_user permission can therefore make themselves staff and then become superuser through the Django Admin panel. Successful exploitation gives full, persistent control of the instance, including access to vulnerability reports and infrastructure data of all teams. A public exploit and a write-up were published by Hakai Security; the article does not report in-the-wild exploitation.

Technical Details

  • Root cause: in dojo/api_v2/serializers.py, UserSerializer exposes both is_staff and is_superuser but only blocks non-superusers from modifying is_superuser.
  • dojo/authorization/query_registrations.py treats is_staff as unrestricted, so staff bypasses all RBAC. Staff can also reach /admin/.
  • Phase 1: the attacker obtains a token via /api/v2/api-token-auth/ and sends a PATCH to /api/v2/users/[USER_ID]/ with {"is_staff":true}. The same request with is_superuser is rejected.
  • Phase 2: with is_staff=true, the attacker opens /admin/, edits their own user in Auth → Users and ticks is_superuser. The default Django UserAdmin does not prevent this.
  • Prerequisites: a low-privilege authenticated account, the auth.change_user permission and REST API access.
  • Affected version is given as 2.59.0; fixes are in 2.58.3, 2.58.4 and 3.0.0 (commit 68a272f, PR #14952).
  • Risk scenarios: insider threat, compromise of a helpdesk-type account, and cross-tenant data access in multi-tenant deployments.

Remediation

  • Update to DefectDojo 2.58.3, 2.58.4 or 3.0.0+.
  • The fix adds an is_staff validation in the serializer, restricts Django Admin access to superusers and disables Django Admin by default (DD_DJANGO_ADMIN_ENABLED=false).
  • Audit API logs for PATCH requests to /api/v2/users/ that include is_staff.
  • Review accounts with is_staff and remove the flag where it is not needed.
  • Monitor changes to privileged flags and keep Django Admin disabled in production unless strictly necessary.

Linha do tempo

  1. yokai.hakaisecurity.io ↗ · pub. 25/09/2026 17:03 · coletado 19/10 18:03 primeiro registro

    CVE-2026-16764: OWASP DefectDojo REST API flaw lets low-privilege users escalate to superuser via is_staff

    ler a análise desta fonte

    A privilege escalation flaw, CVE-2026-16764 (GHSA-w2j3-x3j3-mm43, CVSS 3.1 7.8, CWE-269), affects OWASP DefectDojo. The REST API UserSerializer validates changes to is_superuser but not to is_staff. An authenticated user holding only the delegated auth.change_user permission can therefore make themselves staff and then become superuser through the Django Admin panel. Successful exploitation gives full, persistent control of the instance, including access to vulnerability reports and infrastructure data of all teams. A public exploit and a write-up were published by Hakai Security; the article does not report in-the-wild exploitation.

    Technical Details

    • Root cause: in dojo/api_v2/serializers.py, UserSerializer exposes both is_staff and is_superuser but only blocks non-superusers from modifying is_superuser.
    • dojo/authorization/query_registrations.py treats is_staff as unrestricted, so staff bypasses all RBAC. Staff can also reach /admin/.
    • Phase 1: the attacker obtains a token via /api/v2/api-token-auth/ and sends a PATCH to /api/v2/users/[USER_ID]/ with {"is_staff":true}. The same request with is_superuser is rejected.
    • Phase 2: with is_staff=true, the attacker opens /admin/, edits their own user in Auth → Users and ticks is_superuser. The default Django UserAdmin does not prevent this.
    • Prerequisites: a low-privilege authenticated account, the auth.change_user permission and REST API access.
    • Affected version is given as 2.59.0; fixes are in 2.58.3, 2.58.4 and 3.0.0 (commit 68a272f, PR #14952).
    • Risk scenarios: insider threat, compromise of a helpdesk-type account, and cross-tenant data access in multi-tenant deployments.

    Remediation

    • Update to DefectDojo 2.58.3, 2.58.4 or 3.0.0+.
    • The fix adds an is_staff validation in the serializer, restricts Django Admin access to superusers and disables Django Admin by default (DD_DJANGO_ADMIN_ENABLED=false).
    • Audit API logs for PATCH requests to /api/v2/users/ that include is_staff.
    • Review accounts with is_staff and remove the flag where it is not needed.
    • Monitor changes to privileged flags and keep Django Admin disabled in production unless strictly necessary.