CVE-2026-49292 (GCVE-0-2026-49292)
Vulnerability from cvelistv5 – Published: 2026-09-17 18:27 – Updated: 2026-09-17 19:11
VLAI
EPSS
VEX
Title
Kiwi TCMS: The /init-db/ page renders and responds to requests after first use
Summary
Kiwi TCMS is an open source test management system. Prior to 16.0, the unauthenticated /init-db/ page handled by InitDBView in tcms/core/views.py remains reachable after initial setup and proxies repeated requests to Kiwi/manage.py migrate. The migration command is reentrant, so repeated access reports that no migrations are available and does not cause data loss, alter application state, reveal confidential information, or produce a documented availability impact. This issue is fixed in version 16.0.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 19:11 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/kiwitcms/Kiwi/security/advisor… | x_refsource_CONFIRM |
| https://github.com/kiwitcms/Kiwi/pull/4364 | x_refsource_MISC |
| https://github.com/kiwitcms/Kiwi/commit/d364ec47e… | x_refsource_MISC |
| https://github.com/kiwitcms/Kiwi/releases/tag/v16.0 | x_refsource_MISC |
| https://kiwitcms.org/blog/kiwi-tcms-team/2026/06/… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-49292",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T19:11:03.451229Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T19:11:15.766Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Kiwi",
"vendor": "kiwitcms",
"versions": [
{
"status": "affected",
"version": "\u003c 16.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kiwi TCMS is an open source test management system. Prior to 16.0, the unauthenticated /init-db/ page handled by InitDBView in tcms/core/views.py remains reachable after initial setup and proxies repeated requests to Kiwi/manage.py migrate. The migration command is reentrant, so repeated access reports that no migrations are available and does not cause data loss, alter application state, reveal confidential information, or produce a documented availability impact. This issue is fixed in version 16.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 0,
"baseSeverity": "NONE",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T18:27:10.306Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-v8rp-6xcv-fwgh",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-v8rp-6xcv-fwgh"
},
{
"name": "https://github.com/kiwitcms/Kiwi/pull/4364",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kiwitcms/Kiwi/pull/4364"
},
{
"name": "https://github.com/kiwitcms/Kiwi/commit/d364ec47ec5a77b98bad2ab702b0406075a0e081",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kiwitcms/Kiwi/commit/d364ec47ec5a77b98bad2ab702b0406075a0e081"
},
{
"name": "https://github.com/kiwitcms/Kiwi/releases/tag/v16.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kiwitcms/Kiwi/releases/tag/v16.0"
},
{
"name": "https://kiwitcms.org/blog/kiwi-tcms-team/2026/06/05/kiwi-tcms-160",
"tags": [
"x_refsource_MISC"
],
"url": "https://kiwitcms.org/blog/kiwi-tcms-team/2026/06/05/kiwi-tcms-160"
}
],
"source": {
"advisory": "GHSA-v8rp-6xcv-fwgh",
"discovery": "UNKNOWN"
},
"title": "Kiwi TCMS: The /init-db/ page renders and responds to requests after first use"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-49292",
"datePublished": "2026-09-17T18:27:10.306Z",
"dateReserved": "2026-05-28T20:07:58.862Z",
"dateUpdated": "2026-09-17T19:11:15.766Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-49292",
"date": "2026-10-01",
"epss": "0.00439",
"percentile": "0.35841"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"product": "Kiwi",
"vendor": "kiwitcms",
"versions": [
{
"status": "affected",
"version": "\u003c 16.0"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Kiwi TCMS is an open source test management system. Prior to 16.0, the unauthenticated /init-db/ page handled by InitDBView in tcms/core/views.py remains reachable after initial setup and proxies repeated requests to Kiwi/manage.py migrate. The migration command is reentrant, so repeated access reports that no migrations are available and does not cause data loss, alter application state, reveal confidential information, or produce a documented availability impact. This issue is fixed in version 16.0."
}
],
"id": "CVE-2026-49292",
"lastModified": "2026-09-30T17:51:56.193",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 0.0,
"baseSeverity": "NONE",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 0.0,
"source": "security-advisories@github.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-49292",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T19:11:03.451229Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-09-17T19:16:48.960",
"references": [
{
"source": "security-advisories@github.com",
"url": "https://github.com/kiwitcms/Kiwi/commit/d364ec47ec5a77b98bad2ab702b0406075a0e081"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/kiwitcms/Kiwi/pull/4364"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/kiwitcms/Kiwi/releases/tag/v16.0"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-v8rp-6xcv-fwgh"
},
{
"source": "security-advisories@github.com",
"url": "https://kiwitcms.org/blog/kiwi-tcms-team/2026/06/05/kiwi-tcms-160"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-862"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-49292",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T19:11:03.451229Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T19:11:10.589Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Kiwi",
"vendor": "kiwitcms",
"versions": [
{
"status": "affected",
"version": "\u003c 16.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kiwi TCMS is an open source test management system. Prior to 16.0, the unauthenticated /init-db/ page handled by InitDBView in tcms/core/views.py remains reachable after initial setup and proxies repeated requests to Kiwi/manage.py migrate. The migration command is reentrant, so repeated access reports that no migrations are available and does not cause data loss, alter application state, reveal confidential information, or produce a documented availability impact. This issue is fixed in version 16.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 0,
"baseSeverity": "NONE",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T18:27:10.306Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-v8rp-6xcv-fwgh",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-v8rp-6xcv-fwgh"
},
{
"name": "https://github.com/kiwitcms/Kiwi/pull/4364",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kiwitcms/Kiwi/pull/4364"
},
{
"name": "https://github.com/kiwitcms/Kiwi/commit/d364ec47ec5a77b98bad2ab702b0406075a0e081",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kiwitcms/Kiwi/commit/d364ec47ec5a77b98bad2ab702b0406075a0e081"
},
{
"name": "https://github.com/kiwitcms/Kiwi/releases/tag/v16.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kiwitcms/Kiwi/releases/tag/v16.0"
},
{
"name": "https://kiwitcms.org/blog/kiwi-tcms-team/2026/06/05/kiwi-tcms-160",
"tags": [
"x_refsource_MISC"
],
"url": "https://kiwitcms.org/blog/kiwi-tcms-team/2026/06/05/kiwi-tcms-160"
}
],
"source": {
"advisory": "GHSA-v8rp-6xcv-fwgh",
"discovery": "UNKNOWN"
},
"title": "Kiwi TCMS: The /init-db/ page renders and responds to requests after first use"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-49292",
"datePublished": "2026-09-17T18:27:10.306Z",
"dateReserved": "2026-05-28T20:07:58.862Z",
"dateUpdated": "2026-09-17T19:11:15.766Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
EUVD-2026-371517
European Vulnerability Database identifier assigned by ENISAReserved
2026-10-02 08:38
Assigner
ENISA
Alias of
a CVE record, shown under related vulnerabilities.
This identifier carries no description, severity or references of its own:
they belong to that CVE.
{
"assigner": "ENISA",
"date_reserved": "2026-10-02T08:38:05.640294+00:00",
"id": "EUVD-2026-371517"
}
FKIE_CVE-2026-49292
Vulnerability from fkie_nvd - Published: 2026-09-17 19:16 - Updated: 2026-09-30 17:51
Severity
Summary
Kiwi TCMS is an open source test management system. Prior to 16.0, the unauthenticated /init-db/ page handled by InitDBView in tcms/core/views.py remains reachable after initial setup and proxies repeated requests to Kiwi/manage.py migrate. The migration command is reentrant, so repeated access reports that no migrations are available and does not cause data loss, alter application state, reveal confidential information, or produce a documented availability impact. This issue is fixed in version 16.0.
References
Impacted products
| Vendor | Product | Version |
|---|
{
"affected": [
{
"affectedData": [
{
"product": "Kiwi",
"vendor": "kiwitcms",
"versions": [
{
"status": "affected",
"version": "\u003c 16.0"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Kiwi TCMS is an open source test management system. Prior to 16.0, the unauthenticated /init-db/ page handled by InitDBView in tcms/core/views.py remains reachable after initial setup and proxies repeated requests to Kiwi/manage.py migrate. The migration command is reentrant, so repeated access reports that no migrations are available and does not cause data loss, alter application state, reveal confidential information, or produce a documented availability impact. This issue is fixed in version 16.0."
}
],
"id": "CVE-2026-49292",
"lastModified": "2026-09-30T17:51:56.193",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 0.0,
"baseSeverity": "NONE",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 0.0,
"source": "security-advisories@github.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-49292",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T19:11:03.451229Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-09-17T19:16:48.960",
"references": [
{
"source": "security-advisories@github.com",
"url": "https://github.com/kiwitcms/Kiwi/commit/d364ec47ec5a77b98bad2ab702b0406075a0e081"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/kiwitcms/Kiwi/pull/4364"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/kiwitcms/Kiwi/releases/tag/v16.0"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-v8rp-6xcv-fwgh"
},
{
"source": "security-advisories@github.com",
"url": "https://kiwitcms.org/blog/kiwi-tcms-team/2026/06/05/kiwi-tcms-160"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-862"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
GHSA-V8RP-6XCV-FWGH
Vulnerability from github – Published: 2026-07-02 20:55 – Updated: 2026-07-02 20:55
VLAI
Summary
Kiwi TCMS's /init-db/ page renders and responds to requests after first use
Details
Kiwi TCMS provides the /init-db/ page as part of its setup mechanism for administrators who prefer a browser instead of the command line. In previous versions of Kiwi TCMS this page still renders and responds to requests even after first use.
Impact
The /init-db/ page does not require any user authentication because it is the first setup operation that needs to be executed in order for Kiwi TCMS to function. Database initialization happens before there are any user accounts available!
While that looks serious at first the /init-db/ page is merely a proxy behind the /Kiwi/manage.py migrate command, which itself is designed to be reentrant. In the case of repeated access to the /init-db/ page after first use the output is:
Running migrations:
No migrations to apply.
as shown on the screenshots below:
- There is no data loss because migrations result in a no-op if they are already applied!
- No application state is altered because all state changes have already been applied!
- No confidential information revealed because database migrations only report status on migrations which are clearly visible in source code!
Remediation
The /init-db/ page has been modified to short-circuit itself if migrations have already been applied, resulting in a no-op on the webUI layer as well.
Severity
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "kiwitcms"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "12.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-49292"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-02T20:55:22Z",
"nvd_published_at": null,
"severity": "LOW"
},
"details": "Kiwi TCMS provides the /init-db/ page as part of its setup mechanism for administrators who prefer a browser instead of the command line. In previous versions of Kiwi TCMS this page still renders and responds to requests even after first use.\n\n### Impact\n\nThe /init-db/ page does not require any user authentication because it is the first setup operation that needs to be executed in order for Kiwi TCMS to function. Database initialization happens before there are any user accounts available!\n\nWhile that looks serious at first the /init-db/ page is merely a proxy behind the `/Kiwi/manage.py migrate` command, which itself is designed to be reentrant. In the case of repeated access to the /init-db/ page after first use the output is:\n```\nRunning migrations:\n No migrations to apply.\n```\nas shown on the screenshots below:\n\n\u003cimg width=\"1911\" height=\"992\" alt=\"2222\" src=\"https://github.com/user-attachments/assets/9f661c71-b305-4380-aadf-0732321b3666\" /\u003e\n\n\u003cimg width=\"1913\" height=\"1020\" alt=\"3333\" src=\"https://github.com/user-attachments/assets/10f8553e-675d-42be-9adc-cd5613df015c\" /\u003e\n\n- There is no data loss because migrations result in a no-op if they are already applied!\n- No application state is altered because all state changes have already been applied! \n- No confidential information revealed because database migrations only report status on migrations which are clearly visible in source code!\n\n### Remediation\n\nThe /init-db/ page has been modified to short-circuit itself if migrations have already been applied, resulting in a no-op on the webUI layer as well.",
"id": "GHSA-v8rp-6xcv-fwgh",
"modified": "2026-07-02T20:55:22Z",
"published": "2026-07-02T20:55:22Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-v8rp-6xcv-fwgh"
},
{
"type": "PACKAGE",
"url": "https://github.com/kiwitcms/Kiwi"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U",
"type": "CVSS_V4"
}
],
"summary": "Kiwi TCMS\u0027s /init-db/ page renders and responds to requests after first use"
}
PYSEC-2026-2553
Vulnerability from pysec - Published: 2026-07-13 15:46 - Updated: 2026-07-13 16:04
VLAI
Details
Kiwi TCMS provides the /init-db/ page as part of its setup mechanism for administrators who prefer a browser instead of the command line. In previous versions of Kiwi TCMS this page still renders and responds to requests even after first use.
Impact
The /init-db/ page does not require any user authentication because it is the first setup operation that needs to be executed in order for Kiwi TCMS to function. Database initialization happens before there are any user accounts available!
While that looks serious at first the /init-db/ page is merely a proxy behind the /Kiwi/manage.py migrate command, which itself is designed to be reentrant. In the case of repeated access to the /init-db/ page after first use the output is:
Running migrations:
No migrations to apply.
as shown on the screenshots below:
- There is no data loss because migrations result in a no-op if they are already applied!
- No application state is altered because all state changes have already been applied!
- No confidential information revealed because database migrations only report status on migrations which are clearly visible in source code!
Remediation
The /init-db/ page has been modified to short-circuit itself if migrations have already been applied, resulting in a no-op on the webUI layer as well.
Severity
Impacted products
| Name | purl | kiwitcms | pkg:pypi/kiwitcms |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "kiwitcms",
"purl": "pkg:pypi/kiwitcms"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "12.4"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"10.0",
"10.1",
"10.2",
"10.3",
"10.3.999",
"10.4",
"10.5",
"11.0",
"11.1",
"11.3",
"11.4",
"11.5",
"11.6",
"11.7",
"12.0",
"12.1",
"12.2",
"12.3",
"12.4",
"6.10",
"6.11",
"6.2.1",
"6.3",
"6.4",
"6.5",
"6.5.3",
"6.6",
"6.7",
"6.8",
"6.9",
"7.0",
"7.1",
"7.2",
"7.2.1",
"7.3",
"8.0",
"8.1",
"8.1.99",
"8.2",
"8.3",
"8.4",
"8.5",
"8.6",
"8.6.1",
"8.7",
"8.8",
"8.9",
"9.0",
"9.999"
]
}
],
"aliases": [
"CVE-2026-49292",
"GHSA-v8rp-6xcv-fwgh"
],
"details": "Kiwi TCMS provides the /init-db/ page as part of its setup mechanism for administrators who prefer a browser instead of the command line. In previous versions of Kiwi TCMS this page still renders and responds to requests even after first use.\n\n### Impact\n\nThe /init-db/ page does not require any user authentication because it is the first setup operation that needs to be executed in order for Kiwi TCMS to function. Database initialization happens before there are any user accounts available!\n\nWhile that looks serious at first the /init-db/ page is merely a proxy behind the `/Kiwi/manage.py migrate` command, which itself is designed to be reentrant. In the case of repeated access to the /init-db/ page after first use the output is:\n```\nRunning migrations:\n No migrations to apply.\n```\nas shown on the screenshots below:\n\n\u003cimg width=\"1911\" height=\"992\" alt=\"2222\" src=\"https://github.com/user-attachments/assets/9f661c71-b305-4380-aadf-0732321b3666\" /\u003e\n\n\u003cimg width=\"1913\" height=\"1020\" alt=\"3333\" src=\"https://github.com/user-attachments/assets/10f8553e-675d-42be-9adc-cd5613df015c\" /\u003e\n\n- There is no data loss because migrations result in a no-op if they are already applied!\n- No application state is altered because all state changes have already been applied! \n- No confidential information revealed because database migrations only report status on migrations which are clearly visible in source code!\n\n### Remediation\n\nThe /init-db/ page has been modified to short-circuit itself if migrations have already been applied, resulting in a no-op on the webUI layer as well.",
"id": "PYSEC-2026-2553",
"modified": "2026-07-13T16:04:27.830877Z",
"published": "2026-07-13T15:46:27.733373Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-v8rp-6xcv-fwgh"
},
{
"type": "PACKAGE",
"url": "https://github.com/kiwitcms/Kiwi"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/kiwitcms"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-v8rp-6xcv-fwgh"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49292"
}
],
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U",
"type": "CVSS_V4"
}
],
"summary": "Kiwi TCMS\u0027s /init-db/ page renders and responds to requests after first use"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…