CVE-2026-16210 Details
Description
A vulnerability was found in newpanjing simpleui 2026.01.13. This affects the function self.get_action of the file simpleui/admin.py of the component AjaxAdmin AJAX Endpoint. Performing a manipulation results in missing authentication. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
A vulnerability exists in newpanjing simpleui version 2026.01.13, specifically within the AjaxAdmin component's AJAX endpoint. The issue arises in the self.get_action function of simpleui/admin.py, where authentication checks are bypassed. This vulnerability allows for remote exploitation, enabling unauthorized users to execute actions on admin models via POST requests. The problem has been publicly disclosed, but the project maintainers have not yet addressed it.
Wrap the custom AJAX views in 'self.admin_site.admin_view()' to restore proper authentication and authorization checks. Additionally, reject unsafe HTTP methods and maintain Django's default CSRF protection.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 19, 2026CISA-ADP
Assessed Jul 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/newpanjing/simpleui/ | [email protected] | ProductSource CodeVendor |
| https://github.com/newpanjing/simpleui/issues/537 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://vuldb.com/cve/CVE-2026-16210 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/857929 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/380026 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/380026/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| newpanjing simpleui | 2026.01.13 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | CVE Modified | CISA-ADP |
| Jul 19, 2026 | New CVE Received | [email protected] |