0

CVE-2026-49292

Kiwi TCMS: The /init-db/ page renders and responds to requests after first use

Kiwi TCMS is an open source test management system. Prior to 16.0, the unauthenticated /init-db/ page handled by InitDBView in tcms/core/views.py remains reachable after initial setup and proxies repeated requests to Kiwi/manage.py migrate. The migration command is reentrant, so repeated access reports that no migrations are available and does not cause data loss, alter application state, reveal confidential information, or produce a documented availability impact. This issue is fixed in version 16.0.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
Herstellerkiwitcms
≫
Produkt Kiwi
Version < 16.0
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 0 3.9 0
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-v8rp-6xcv-fwgh
https://github.com/kiwitcms/Kiwi/pull/4364
https://github.com/kiwitcms/Kiwi/commit/d364ec47ec5a77b98bad2ab702b0406075a0e081
https://github.com/kiwitcms/Kiwi/releases/tag/v16.0
https://kiwitcms.org/blog/kiwi-tcms-team/2026/06/05/kiwi-tcms-160