CVE-2026-6580

CVE-2026-6580 affects DjangoBlog versions up to 2.1.0.0 and involves improper handling of the Amap API Call Handler in the owntracks/views.py component, specifically related to manipulation of the key argument that leads to use of a hard-coded cryptographic key. This vulnerability enables attackers to potentially compromise the confidentiality, integrity, and availability of affected systems. The vulnerability carries a CVSS 3.1 score of 7.3 (HIGH), with a network-based attack vector requiring no authentication or user interaction, making it relatively easy to exploit remotely. The impact is moderate, affecting confidentiality, integrity, and availability of the application. Public exploit code is available, and the vulnerability has been actively disclosed despite the vendor's lack of response to early notification. While the EPSS score of 0.000380 suggests limited real-world exploitation activity currently, the active presence on threat tracking lists and public disclosure of exploit details warrant immediate patching, particularly for internet-facing DjangoBlog installations.