PT-2026-61043 · Gerapy · Gerapy

Galaxyn · CVE-2026-16209 · Published 2026-07-19 · Updated 2026-07-19

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Gerapy versions prior to 0.9.14

Description An issue in the Project Upload Endpoint within the gerapy/server/core/views.py file allows remote attackers to bypass authentication. This missing authentication enables unauthenticated remote access to the system.

Recommendations Apply patch bd4891c60315f17611a3b7a651ffe0fba7cfe71e to resolve the issue. Restrict access to the Project Upload Endpoint to minimize the risk of exploitation.

Exploit

Fix

Missing Authentication

Improper Authentication

Weakness Enumeration

CWE-306

CWE-287

Related Identifiers

CVE-2026-16209

Affected Products

Gerapy

References · 10

• 🔥 https://github.com/Gerapy/Gerapy/issues/317 · Exploit
• https://github.com/Gerapy/Gerapy/pull/319 · Patch
• https://github.com/Gerapy/Gerapy/commit/bd4891c60315f17611a3b7a651ffe0fba7cfe71e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-16209 · Security Note
• https://vuldb.com/submit/857926 · Note
• https://twitter.com/VulmonFeeds/status/2078705027556798640 · Twitter Post
• https://vuldb.com/cve/CVE-2026-16209 · Note
• https://github.com/Gerapy/Gerapy · Note
• https://vuldb.com/vuln/380025/cti · Note
• https://vuldb.com/vuln/380025 · Note