The vulnerability resides in the UserSerializer component of OWASP DefectDojo's API/Web layer. An attacker can modify the is_staff parameter when serializing a user, which the code internally uses to set staff privileges. This capability can elevate a non‑staff account to staff level, granting the attacker access to administrative functions, sensitive data, and potentially full control over the DefectDojo instance. The weakness is a classic privileged escalation flaw identified by CWE‑266 and CWE‑269.

The issue affects DefectDojo version 2.59.0, a release that was never intended for public distribution and has already been removed from the official repository. The affected product is OWASP DefectDojo – all deployments running that exact version are vulnerable. The official fix is incorporated in both the 2.58.3 release and the newer 3.0.0 release, as well as the patch commit identified by 68a272f299d096249fd3ba9c2676bf69012857bf.

The CVSS score of 5.3 places the vulnerability in the medium severity range, and the EPSS score of less than 1% indicates a very low probability of widespread exploitation at present. Because the exploit can be performed from a remote API call, an attacker who can reach the DefectDojo instance and craft the request could trigger the privilege escalation without further credentials. The vulnerability is not currently listed in the CISA KEV catalog, but the public availability of an exploit commit suggests that security teams should address it promptly.