CVE-2026-16209 describes a missing authentication vulnerability in Gerapy versions 0.9.0 through 0.9.13 affecting the Project Upload Endpoint component. The vulnerability resides in an unspecified function within the file gerapy/server/core/views.py. This allows remote attackers to bypass authentication controls and potentially perform unauthorized actions related to project uploads. The vulnerability has been publicly disclosed, and a patch is available identified by commit bd4891c60315f17611a3b7a651ffe0fba7cfe71e. No official vendor advisory or detailed remediation instructions are provided in the data, but applying the patch is advised.

The vulnerability enables remote attackers to bypass authentication on the Project Upload Endpoint, potentially allowing unauthorized access or manipulation of project uploads. The CVSS 4.0 score of 6.9 reflects a medium severity with network attack vector, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability.

A patch identified by commit bd4891c60315f17611a3b7a651ffe0fba7cfe71e is available and should be applied to resolve the missing authentication vulnerability. Since no official vendor advisory or remediation level is provided, users should verify the patch from the official Gerapy source repository or trusted channels and apply it promptly. Patch status is not yet confirmed by a vendor advisory; check the vendor's official resources for current remediation guidance.