CVE-2026-7510 — A vulnerability was determined in OWAP DefectDojo up to

title: Potential Authorization Bypass via OWAP DefectDojo Benchmark/Engagement/Product/Survey Manipulation - CVE-2026-7510
id: scw-2026-04-30-ai-1
status: experimental
level: high
description: |
  This rule detects potential exploitation of CVE-2026-7510 in OWAP DefectDojo versions prior to 2.56.0. The vulnerability allows for authorization bypass by manipulating specific components (Benchmark, Engagement, Product, Survey). This detection looks for requests to these specific paths, potentially with an ID parameter, that result in a successful (200) status code, indicating a possible bypass.
author: SCW Feed Engine (AI-generated)
date: 2026-04-30
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-7510/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/benchmark/'
          - '/engagement/'
          - '/product/'
          - '/survey/'
      cs-method|exact: 'GET'
      cs-uri-query|contains:
          - 'id=' # Assuming ID manipulation is part of the exploit
      sc-status|exact: '200' # Successful response after bypass
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse