CVE-2026-16215
Received Received - Intake

Missing Authorization in Django-Jet OAuth Handler

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: VulDB

Description
A security flaw has been discovered in geex-arts django-jet up to 1.0.8. This impacts an unknown function of the component OAuth Credential Revoke Handler. Performing a manipulation results in missing authorization. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-19
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-16215
EUVD
EUVD-2026-45426

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
geex-arts django-jet to 1.0.8 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a security flaw in geex-arts django-jet up to version 1.0.8. It involves an issue in the OAuth Credential Revoke Handler component where authorization checks are missing. This allows remote attackers to manipulate the system without proper permissions. The exploit has been publicly disclosed and may already be used in attacks.

Detection Guidance

Since this vulnerability involves missing authorization in the OAuth Credential Revoke Handler of django-jet up to 1.0.8, check if your system uses this version or earlier. Inspect logs for unauthorized OAuth credential revocation attempts or unexpected access to dashboard modules by non-owners. Review network traffic for suspicious OAuth flow interactions.

Impact Analysis

The vulnerability could allow unauthorized users to revoke OAuth credentials remotely, potentially disrupting access for legitimate users. This may lead to service disruptions or unauthorized access to protected resources if exploited.

Compliance Impact

The vulnerability allows unauthorized access and modification of dashboard modules and OAuth credentials due to missing authorization checks. This could lead to unauthorized data access or deletion, potentially violating GDPR's data protection requirements or HIPAA's safeguards for protected health information if such data is involved.

Mitigation Strategies

Immediately upgrade geex-arts django-jet to a version beyond 1.0.8 where the vulnerability is fixed. If no patch is available, consider disabling the OAuth Credential Revoke Handler component or restricting network access to it until a fix is released.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16215. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart