7.5
CVE-2026-16209
- EPSS 0.41%
- Veröffentlicht 19.07.2026 03:00:11
- Zuletzt bearbeitet 20.07.2026 13:30:32
- CVE-Watchlists
- Unerledigt
Gerapy Project Upload Endpoint views.py missing authentication
A vulnerability has been found in Gerapy up to 0.9.13. The impacted element is an unknown function of the file gerapy/server/core/views.py of the component Project Upload Endpoint. Such manipulation leads to missing authentication. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is bd4891c60315f17611a3b7a651ffe0fba7cfe71e. Applying a patch is advised to resolve this issue.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
Herstellern/a
≫
Produkt
Gerapy
Version
0.9.0
Status
affected
Version
0.9.1
Status
affected
Version
0.9.2
Status
affected
Version
0.9.3
Status
affected
Version
0.9.4
Status
affected
Version
0.9.5
Status
affected
Version
0.9.6
Status
affected
Version
0.9.7
Status
affected
Version
0.9.8
Status
affected
Version
0.9.9
Status
affected
Version
0.9.10
Status
affected
Version
0.9.11
Status
affected
Version
0.9.12
Status
affected
Version
0.9.13
Status
affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.41% | 0.332 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| cna@vuldb.com | 5.5 | 0 | 0 |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
|
| cna@vuldb.com | 7.3 | 3.9 | 3.4 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
|
| cna@vuldb.com | 7.5 | 10 | 6.4 |
AV:N/AC:L/Au:N/C:P/I:P/A:P
|
CWE-287 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-306 Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
https://vuldb.com/vuln/380025
https://vuldb.com/vuln/380025/cti
https://vuldb.com/cve/CVE-2026-16209
https://vuldb.com/submit/857926
https://github.com/Gerapy/Gerapy/issues/317
https://github.com/Gerapy/Gerapy/pull/319
https://github.com/Gerapy/Gerapy/commit/bd4891c60315f17611a3b7a651ffe0fba7cfe71e
https://github.com/Gerapy/Gerapy/