CVE-2026-16214
Received Received - Intake

Authorization Bypass in Django-Jet Dashboard Module

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: VulDB

Description
A vulnerability was identified in geex-arts django-jet up to 1.0.8. This affects an unknown function of the file jet/dashboard/views.py of the component Dashboard Module. Such manipulation leads to authorization bypass. The attack can be executed remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-19
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-16214
EUVD
EUVD-2026-45425

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
geex-arts django-jet to 1.0.8 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization bypass in the django-jet dashboard module up to version 1.0.8. It allows remote attackers to manipulate dashboard views by changing primary keys, enabling unauthorized access or modifications to other users' dashboard modules. The exploit is publicly available and the vendor has not responded to the reported issue.

Detection Guidance

Check for unauthorized access to dashboard modules by reviewing logs for requests to jet/dashboard/views.py with modified primary keys. Inspect OAuth credential revoke endpoints for unauthenticated calls. Use Django admin logs to detect suspicious activity.

Impact Analysis

If you use django-jet with staff users, attackers could access or modify your dashboard modules without permission. They could also delete OAuth credentials for services like Google Analytics or Yandex Metrika without authentication. Additionally, attackers might trick you into linking third-party credentials to their modules.

Compliance Impact

The vulnerability allows unauthorized access and modification of dashboard modules by staff users, which could lead to unauthorized data exposure or manipulation. This may violate GDPR principles of data integrity and confidentiality if personal data is involved, and HIPAA requirements for access controls if protected health information is exposed.

Mitigation Strategies

Upgrade to the latest version of django-jet if available. Implement object-level authorization checks in dashboard views. Restrict access to OAuth revoke endpoints and enforce authentication. Use unpredictable state parameters for OAuth flows and bind them to sessions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16214. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart