CVE-2026-16504

{
  "id": "CVE-2026-16504",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-31T16:16:58.873",
  "lastModified": "2026-10-23T23:10:00.157",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a default database password (\"zulip\"), and DISABLE_HTTPS=True."
    },
    {
      "lang": "es",
      "value": "El despliegue de la plantilla de Zulip de un solo clic de VPS.org despliega una clave de firma de aplicación codificada de forma fija, una contraseña de base de datos predeterminada (’zulip’) y DISABLE_HTTPS=True."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "VPS.org",
          "product": "Zulip template",
          "versions": [
            {
              "version": "N/A",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-03T17:17:56.627151Z",
          "id": "CVE-2026-16504",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-321"
        },
        {
          "lang": "en",
          "value": "CWE-1188"
        },
        {
          "lang": "en",
          "value": "CWE-1393"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://kb.cert.org/vuls/id/243636",
      "source": "[email protected]"
    }
  ]
}