CVE-2026-16214
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
A vulnerability was identified in geex-arts django-jet up to 1.0.8. This affects an unknown function of the file jet/dashboard/views.py of the component Dashboard Module. Such manipulation leads to authorization bypass. The attack can be executed remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Risk Assessment
The risk is that an attacker can remotely bypass authorization, potentially gaining unauthorized access to dashboard functions and possibly escalating privileges.
Recommendation
Immediately stop using django-jet until a patch is released, or apply temporary mitigations such as restricting access to the dashboard.
Other vulnerabilities in django-jet
See all- CVE-2026-16216Medium
In geex-arts django-jet up to version 1.0.8, a cross-site request forgery vulnerability exists in the OAuth Handler component. The attack can be performed remotely, and the exploit is publicly available. The project was notified but has not responded.
- CVE-2026-16215Medium
A security flaw was discovered in django-jet up to version 1.0.8 in the OAuth Credential Revoke Handler component. Missing authorization in this function allows remote attacks without required privileges. The exploit has been publicly released and may be used in real attacks.
Original NVD description (English source)
A vulnerability was identified in geex-arts django-jet up to 1.0.8. This affects an unknown function of the file jet/dashboard/views.py of the component Dashboard Module. Such manipulation leads to authorization bypass. The attack can be executed remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.