CVE-2026-16217 (GCVE-0-2026-16217)
Vulnerability from cvelistv5 – Published: 2026-07-19 05:30 – Updated: 2026-07-20 19:08
VLAI
EPSS
VEX
Title
guohongze adminset Delivery Deployment Endpoint deli.py authorization
Summary
A security vulnerability has been detected in guohongze adminset up to 0.61. Affected by this vulnerability is an unknown functionality of the file delivery/deli.py of the component Delivery Deployment Endpoint. The manipulation of the argument project_id leads to authorization bypass. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/380040 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/380040/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-16217 | third-party-advisory |
| https://vuldb.com/submit/857950 | third-party-advisory |
| https://github.com/guohongze/adminset/issues/161 | exploitissue-tracking |
| https://github.com/guohongze/adminset/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| guohongze | adminset |
Affected:
0.1
Affected: 0.2 Affected: 0.3 Affected: 0.4 Affected: 0.5 Affected: 0.6 Affected: 0.7 Affected: 0.8 Affected: 0.9 Affected: 0.10 Affected: 0.11 Affected: 0.12 Affected: 0.13 Affected: 0.14 Affected: 0.15 Affected: 0.16 Affected: 0.17 Affected: 0.18 Affected: 0.19 Affected: 0.20 Affected: 0.21 Affected: 0.22 Affected: 0.23 Affected: 0.24 Affected: 0.25 Affected: 0.26 Affected: 0.27 Affected: 0.28 Affected: 0.29 Affected: 0.30 Affected: 0.31 Affected: 0.32 Affected: 0.33 Affected: 0.34 Affected: 0.35 Affected: 0.36 Affected: 0.37 Affected: 0.38 Affected: 0.39 Affected: 0.40 Affected: 0.41 Affected: 0.42 Affected: 0.43 Affected: 0.44 Affected: 0.45 Affected: 0.46 Affected: 0.47 Affected: 0.48 Affected: 0.49 Affected: 0.50 Affected: 0.51 Affected: 0.52 Affected: 0.53 Affected: 0.54 Affected: 0.55 Affected: 0.56 Affected: 0.57 Affected: 0.58 Affected: 0.59 Affected: 0.60 Affected: 0.61 cpe:2.3:a:guohongze:adminset:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16217",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-20T18:02:08.216696Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-20T19:08:51.475Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:guohongze:adminset:*:*:*:*:*:*:*:*"
],
"modules": [
"Delivery Deployment Endpoint"
],
"product": "adminset",
"vendor": "guohongze",
"versions": [
{
"status": "affected",
"version": "0.1"
},
{
"status": "affected",
"version": "0.2"
},
{
"status": "affected",
"version": "0.3"
},
{
"status": "affected",
"version": "0.4"
},
{
"status": "affected",
"version": "0.5"
},
{
"status": "affected",
"version": "0.6"
},
{
"status": "affected",
"version": "0.7"
},
{
"status": "affected",
"version": "0.8"
},
{
"status": "affected",
"version": "0.9"
},
{
"status": "affected",
"version": "0.10"
},
{
"status": "affected",
"version": "0.11"
},
{
"status": "affected",
"version": "0.12"
},
{
"status": "affected",
"version": "0.13"
},
{
"status": "affected",
"version": "0.14"
},
{
"status": "affected",
"version": "0.15"
},
{
"status": "affected",
"version": "0.16"
},
{
"status": "affected",
"version": "0.17"
},
{
"status": "affected",
"version": "0.18"
},
{
"status": "affected",
"version": "0.19"
},
{
"status": "affected",
"version": "0.20"
},
{
"status": "affected",
"version": "0.21"
},
{
"status": "affected",
"version": "0.22"
},
{
"status": "affected",
"version": "0.23"
},
{
"status": "affected",
"version": "0.24"
},
{
"status": "affected",
"version": "0.25"
},
{
"status": "affected",
"version": "0.26"
},
{
"status": "affected",
"version": "0.27"
},
{
"status": "affected",
"version": "0.28"
},
{
"status": "affected",
"version": "0.29"
},
{
"status": "affected",
"version": "0.30"
},
{
"status": "affected",
"version": "0.31"
},
{
"status": "affected",
"version": "0.32"
},
{
"status": "affected",
"version": "0.33"
},
{
"status": "affected",
"version": "0.34"
},
{
"status": "affected",
"version": "0.35"
},
{
"status": "affected",
"version": "0.36"
},
{
"status": "affected",
"version": "0.37"
},
{
"status": "affected",
"version": "0.38"
},
{
"status": "affected",
"version": "0.39"
},
{
"status": "affected",
"version": "0.40"
},
{
"status": "affected",
"version": "0.41"
},
{
"status": "affected",
"version": "0.42"
},
{
"status": "affected",
"version": "0.43"
},
{
"status": "affected",
"version": "0.44"
},
{
"status": "affected",
"version": "0.45"
},
{
"status": "affected",
"version": "0.46"
},
{
"status": "affected",
"version": "0.47"
},
{
"status": "affected",
"version": "0.48"
},
{
"status": "affected",
"version": "0.49"
},
{
"status": "affected",
"version": "0.50"
},
{
"status": "affected",
"version": "0.51"
},
{
"status": "affected",
"version": "0.52"
},
{
"status": "affected",
"version": "0.53"
},
{
"status": "affected",
"version": "0.54"
},
{
"status": "affected",
"version": "0.55"
},
{
"status": "affected",
"version": "0.56"
},
{
"status": "affected",
"version": "0.57"
},
{
"status": "affected",
"version": "0.58"
},
{
"status": "affected",
"version": "0.59"
},
{
"status": "affected",
"version": "0.60"
},
{
"status": "affected",
"version": "0.61"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "GalaxynX (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in guohongze adminset up to 0.61. Affected by this vulnerability is an unknown functionality of the file delivery/deli.py of the component Delivery Deployment Endpoint. The manipulation of the argument project_id leads to authorization bypass. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-19T05:30:10.201Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-380040 | guohongze adminset Delivery Deployment Endpoint deli.py authorization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/380040"
},
{
"name": "VDB-380040 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/380040/cti"
},
{
"name": "CVE-2026-16217 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-16217"
},
{
"name": "Submit #857950 | guohongze adminset 6c122c2824e6553b09ebd16a1fa05a593198c5ec CWE-639 Authorization Bypass Through User-Controlled Key",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/857950"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/guohongze/adminset/issues/161"
},
{
"tags": [
"product"
],
"url": "https://github.com/guohongze/adminset/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-18T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-07-18T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-07-18T11:58:29.000Z",
"value": "VulDB entry last update"
}
],
"title": "guohongze adminset Delivery Deployment Endpoint deli.py authorization"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-16217",
"datePublished": "2026-07-19T05:30:10.201Z",
"dateReserved": "2026-07-18T09:53:24.724Z",
"dateUpdated": "2026-07-20T19:08:51.475Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-16217",
"date": "2026-07-21",
"epss": "0.0022",
"percentile": "0.12549"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-16217\",\"sourceIdentifier\":\"cna@vuldb.com\",\"published\":\"2026-07-19T06:17:09.863\",\"lastModified\":\"2026-07-20T19:17:19.697\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A security vulnerability has been detected in guohongze adminset up to 0.61. Affected by this vulnerability is an unknown functionality of the file delivery/deli.py of the component Delivery Deployment Endpoint. The manipulation of the argument project_id leads to authorization bypass. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.\"}],\"affected\":[{\"source\":\"cna@vuldb.com\",\"affectedData\":[{\"vendor\":\"guohongze\",\"product\":\"adminset\",\"cpes\":[\"cpe:2.3:a:guohongze:adminset:*:*:*:*:*:*:*:*\"],\"modules\":[\"Delivery Deployment Endpoint\"],\"versions\":[{\"version\":\"0.1\",\"status\":\"affected\"},{\"version\":\"0.2\",\"status\":\"affected\"},{\"version\":\"0.3\",\"status\":\"affected\"},{\"version\":\"0.4\",\"status\":\"affected\"},{\"version\":\"0.5\",\"status\":\"affected\"},{\"version\":\"0.6\",\"status\":\"affected\"},{\"version\":\"0.7\",\"status\":\"affected\"},{\"version\":\"0.8\",\"status\":\"affected\"},{\"version\":\"0.9\",\"status\":\"affected\"},{\"version\":\"0.10\",\"status\":\"affected\"},{\"version\":\"0.11\",\"status\":\"affected\"},{\"version\":\"0.12\",\"status\":\"affected\"},{\"version\":\"0.13\",\"status\":\"affected\"},{\"version\":\"0.14\",\"status\":\"affected\"},{\"version\":\"0.15\",\"status\":\"affected\"},{\"version\":\"0.16\",\"status\":\"affected\"},{\"version\":\"0.17\",\"status\":\"affected\"},{\"version\":\"0.18\",\"status\":\"affected\"},{\"version\":\"0.19\",\"status\":\"affected\"},{\"version\":\"0.20\",\"status\":\"affected\"},{\"version\":\"0.21\",\"status\":\"affected\"},{\"version\":\"0.22\",\"status\":\"affected\"},{\"version\":\"0.23\",\"status\":\"affected\"},{\"version\":\"0.24\",\"status\":\"affected\"},{\"version\":\"0.25\",\"status\":\"affected\"},{\"version\":\"0.26\",\"status\":\"affected\"},{\"version\":\"0.27\",\"status\":\"affected\"},{\"version\":\"0.28\",\"status\":\"affected\"},{\"version\":\"0.29\",\"status\":\"affected\"},{\"version\":\"0.30\",\"status\":\"affected\"},{\"version\":\"0.31\",\"status\":\"affected\"},{\"version\":\"0.32\",\"status\":\"affected\"},{\"version\":\"0.33\",\"status\":\"affected\"},{\"version\":\"0.34\",\"status\":\"affected\"},{\"version\":\"0.35\",\"status\":\"affected\"},{\"version\":\"0.36\",\"status\":\"affected\"},{\"version\":\"0.37\",\"status\":\"affected\"},{\"version\":\"0.38\",\"status\":\"affected\"},{\"version\":\"0.39\",\"status\":\"affected\"},{\"version\":\"0.40\",\"status\":\"affected\"},{\"version\":\"0.41\",\"status\":\"affected\"},{\"version\":\"0.42\",\"status\":\"affected\"},{\"version\":\"0.43\",\"status\":\"affected\"},{\"version\":\"0.44\",\"status\":\"affected\"},{\"version\":\"0.45\",\"status\":\"affected\"},{\"version\":\"0.46\",\"status\":\"affected\"},{\"version\":\"0.47\",\"status\":\"affected\"},{\"version\":\"0.48\",\"status\":\"affected\"},{\"version\":\"0.49\",\"status\":\"affected\"},{\"version\":\"0.50\",\"status\":\"affected\"},{\"version\":\"0.51\",\"status\":\"affected\"},{\"version\":\"0.52\",\"status\":\"affected\"},{\"version\":\"0.53\",\"status\":\"affected\"},{\"version\":\"0.54\",\"status\":\"affected\"},{\"version\":\"0.55\",\"status\":\"affected\"},{\"version\":\"0.56\",\"status\":\"affected\"},{\"version\":\"0.57\",\"status\":\"affected\"},{\"version\":\"0.58\",\"status\":\"affected\"},{\"version\":\"0.59\",\"status\":\"affected\"},{\"version\":\"0.60\",\"status\":\"affected\"},{\"version\":\"0.61\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"cna@vuldb.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":2.1,\"baseSeverity\":\"LOW\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"LOW\",\"vulnIntegrityImpact\":\"LOW\",\"vulnAvailabilityImpact\":\"LOW\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"PROOF_OF_CONCEPT\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"cna@vuldb.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L\",\"baseScore\":6.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.8,\"impactScore\":3.4}],\"cvssMetricV2\":[{\"source\":\"cna@vuldb.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:S/C:P/I:P/A:P\",\"baseScore\":6.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.0,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-07-20T18:02:08.216696Z\",\"id\":\"CVE-2026-16217\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"cna@vuldb.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-285\"},{\"lang\":\"en\",\"value\":\"CWE-639\"}]}],\"references\":[{\"url\":\"https://github.com/guohongze/adminset/\",\"source\":\"cna@vuldb.com\"},{\"url\":\"https://github.com/guohongze/adminset/issues/161\",\"source\":\"cna@vuldb.com\"},{\"url\":\"https://vuldb.com/cve/CVE-2026-16217\",\"source\":\"cna@vuldb.com\"},{\"url\":\"https://vuldb.com/submit/857950\",\"source\":\"cna@vuldb.com\"},{\"url\":\"https://vuldb.com/vuln/380040\",\"source\":\"cna@vuldb.com\"},{\"url\":\"https://vuldb.com/vuln/380040/cti\",\"source\":\"cna@vuldb.com\"}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-16217\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-20T18:02:08.216696Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-20T18:02:14.128Z\"}}], \"cna\": {\"title\": \"guohongze adminset Delivery Deployment Endpoint deli.py authorization\", \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"GalaxynX (VulDB User)\"}, {\"lang\": \"en\", \"type\": \"coordinator\", \"value\": \"VulDB CNA Team\"}], \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 5.3, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P\"}}, {\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 6.3, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R\"}}, {\"cvssV3_0\": {\"version\": \"3.0\", \"baseScore\": 6.3, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R\"}}, {\"cvssV2_0\": {\"version\": \"2.0\", \"baseScore\": 6.5, \"vectorString\": \"AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR\"}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:guohongze:adminset:*:*:*:*:*:*:*:*\"], \"vendor\": \"guohongze\", \"modules\": [\"Delivery Deployment Endpoint\"], \"product\": \"adminset\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.1\"}, {\"status\": \"affected\", \"version\": \"0.2\"}, {\"status\": \"affected\", \"version\": \"0.3\"}, {\"status\": \"affected\", \"version\": \"0.4\"}, {\"status\": \"affected\", \"version\": \"0.5\"}, {\"status\": \"affected\", \"version\": \"0.6\"}, {\"status\": \"affected\", \"version\": \"0.7\"}, {\"status\": \"affected\", \"version\": \"0.8\"}, {\"status\": \"affected\", \"version\": \"0.9\"}, {\"status\": \"affected\", \"version\": \"0.10\"}, {\"status\": \"affected\", \"version\": \"0.11\"}, {\"status\": \"affected\", \"version\": \"0.12\"}, {\"status\": \"affected\", \"version\": \"0.13\"}, {\"status\": \"affected\", \"version\": \"0.14\"}, {\"status\": \"affected\", \"version\": \"0.15\"}, {\"status\": \"affected\", \"version\": \"0.16\"}, {\"status\": \"affected\", \"version\": \"0.17\"}, {\"status\": \"affected\", \"version\": \"0.18\"}, {\"status\": \"affected\", \"version\": \"0.19\"}, {\"status\": \"affected\", \"version\": \"0.20\"}, {\"status\": \"affected\", \"version\": \"0.21\"}, {\"status\": \"affected\", \"version\": \"0.22\"}, {\"status\": \"affected\", \"version\": \"0.23\"}, {\"status\": \"affected\", \"version\": \"0.24\"}, {\"status\": \"affected\", \"version\": \"0.25\"}, {\"status\": \"affected\", \"version\": \"0.26\"}, {\"status\": \"affected\", \"version\": \"0.27\"}, {\"status\": \"affected\", \"version\": \"0.28\"}, {\"status\": \"affected\", \"version\": \"0.29\"}, {\"status\": \"affected\", \"version\": \"0.30\"}, {\"status\": \"affected\", \"version\": \"0.31\"}, {\"status\": \"affected\", \"version\": \"0.32\"}, {\"status\": \"affected\", \"version\": \"0.33\"}, {\"status\": \"affected\", \"version\": \"0.34\"}, {\"status\": \"affected\", \"version\": \"0.35\"}, {\"status\": \"affected\", \"version\": \"0.36\"}, {\"status\": \"affected\", \"version\": \"0.37\"}, {\"status\": \"affected\", \"version\": \"0.38\"}, {\"status\": \"affected\", \"version\": \"0.39\"}, {\"status\": \"affected\", \"version\": \"0.40\"}, {\"status\": \"affected\", \"version\": \"0.41\"}, {\"status\": \"affected\", \"version\": \"0.42\"}, {\"status\": \"affected\", \"version\": \"0.43\"}, {\"status\": \"affected\", \"version\": \"0.44\"}, {\"status\": \"affected\", \"version\": \"0.45\"}, {\"status\": \"affected\", \"version\": \"0.46\"}, {\"status\": \"affected\", \"version\": \"0.47\"}, {\"status\": \"affected\", \"version\": \"0.48\"}, {\"status\": \"affected\", \"version\": \"0.49\"}, {\"status\": \"affected\", \"version\": \"0.50\"}, {\"status\": \"affected\", \"version\": \"0.51\"}, {\"status\": \"affected\", \"version\": \"0.52\"}, {\"status\": \"affected\", \"version\": \"0.53\"}, {\"status\": \"affected\", \"version\": \"0.54\"}, {\"status\": \"affected\", \"version\": \"0.55\"}, {\"status\": \"affected\", \"version\": \"0.56\"}, {\"status\": \"affected\", \"version\": \"0.57\"}, {\"status\": \"affected\", \"version\": \"0.58\"}, {\"status\": \"affected\", \"version\": \"0.59\"}, {\"status\": \"affected\", \"version\": \"0.60\"}, {\"status\": \"affected\", \"version\": \"0.61\"}]}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-07-18T00:00:00.000Z\", \"value\": \"Advisory disclosed\"}, {\"lang\": \"en\", \"time\": \"2026-07-18T02:00:00.000Z\", \"value\": \"VulDB entry created\"}, {\"lang\": \"en\", \"time\": \"2026-07-18T11:58:29.000Z\", \"value\": \"VulDB entry last update\"}], \"references\": [{\"url\": \"https://vuldb.com/vuln/380040\", \"name\": \"VDB-380040 | guohongze adminset Delivery Deployment Endpoint deli.py authorization\", \"tags\": [\"vdb-entry\", \"technical-description\"]}, {\"url\": \"https://vuldb.com/vuln/380040/cti\", \"name\": \"VDB-380040 | CTI Indicators (IOB, IOC, IOA)\", \"tags\": [\"signature\", \"permissions-required\"]}, {\"url\": \"https://vuldb.com/cve/CVE-2026-16217\", \"name\": \"CVE-2026-16217 | CVE Analysis and Report\", \"tags\": [\"third-party-advisory\"]}, {\"url\": \"https://vuldb.com/submit/857950\", \"name\": \"Submit #857950 | guohongze adminset 6c122c2824e6553b09ebd16a1fa05a593198c5ec CWE-639 Authorization Bypass Through User-Controlled Key\", \"tags\": [\"third-party-advisory\"]}, {\"url\": \"https://github.com/guohongze/adminset/issues/161\", \"tags\": [\"exploit\", \"issue-tracking\"]}, {\"url\": \"https://github.com/guohongze/adminset/\", \"tags\": [\"product\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A security vulnerability has been detected in guohongze adminset up to 0.61. Affected by this vulnerability is an unknown functionality of the file delivery/deli.py of the component Delivery Deployment Endpoint. The manipulation of the argument project_id leads to authorization bypass. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-639\", \"description\": \"Authorization Bypass\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-285\", \"description\": \"Improper Authorization\"}]}], \"providerMetadata\": {\"orgId\": \"1af790b2-7ee1-4545-860a-a788eba489b5\", \"shortName\": \"VulDB\", \"dateUpdated\": \"2026-07-19T05:30:10.201Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-16217\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-20T19:08:51.475Z\", \"dateReserved\": \"2026-07-18T09:53:24.724Z\", \"assignerOrgId\": \"1af790b2-7ee1-4545-860a-a788eba489b5\", \"datePublished\": \"2026-07-19T05:30:10.201Z\", \"assignerShortName\": \"VulDB\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…