{"id":"CVE-2026-49292","title":"Kiwi TCMS is an open source test management system","summary":"Kiwi TCMS is an open source test management system. Prior to 16.0, the unauthenticated /init-db/ page handled by InitDBView in tcms/core/views.py remains reachable after initial setup and proxies repeated requests to Kiwi/manage.py migra…","severity":"low","cvss":0,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","cwe":["CWE-862"],"vendor":"kiwitcms","product":"Kiwi","affected":["Kiwi < 16.0"],"published":"2026-09-17","updated":"2026-09-17","sourceUpdated":"2026-09-17T20:16:50.007","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-49292","references":[{"url":"https://github.com/kiwitcms/Kiwi/commit/d364ec47ec5a77b98bad2ab702b0406075a0e081","label":"security-advisories@github.com"},{"url":"https://github.com/kiwitcms/Kiwi/pull/4364","label":"security-advisories@github.com"},{"url":"https://github.com/kiwitcms/Kiwi/releases/tag/v16.0","label":"security-advisories@github.com"},{"url":"https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-v8rp-6xcv-fwgh","label":"security-advisories@github.com"},{"url":"https://kiwitcms.org/blog/kiwi-tcms-team/2026/06/05/kiwi-tcms-160","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-v8rp-6xcv-fwgh"}],"tags":["nvd","cve.org","ghsa","pip"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-17T19:11:03.451229Z"},"ecosystem":"pip","ingestedAt":"2026-07-02T21:44:45.088Z","epss":0.00256,"epssPercentile":0.17546,"slug":"CVE-2026-49292","body":"## Overview\n\nKiwi TCMS is an open source test management system. Prior to 16.0, the unauthenticated /init-db/ page handled by InitDBView in tcms/core/views.py remains reachable after initial setup and proxies repeated requests to Kiwi/manage.py migrate. The migration command is reentrant, so repeated access reports that no migrations are available and does not cause data loss, alter application state, reveal confidential information, or produce a documented availability impact. This issue is fixed in version 16.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-49292)\n\nAffected packages:\n\n- `kiwitcms <= 12.4`\n\nSource: https://github.com/advisories/GHSA-v8rp-6xcv-fwgh","depth":"sunlit","depthScore":14,"depthScoreParts":{"impact":13.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":206511,"id":"CVE-2026-49292","ts":1789673248326,"field":"cvss","old":null,"new":"0"}]}