---
id: CVE-2026-49292
title: Kiwi TCMS is an open source test management system
summary: >-
  Kiwi TCMS is an open source test management system. Prior to 16.0, the
  unauthenticated /init-db/ page handled by InitDBView in tcms/core/views.py
  remains reachable after initial setup and proxies repeated requests to
  Kiwi/manage.py migra…
severity: low
cvss: 0
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N'
cwe:
  - CWE-862
vendor: kiwitcms
product: Kiwi
affected:
  - Kiwi < 16.0
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T20:16:50.007'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-49292'
references:
  - url: >-
      https://github.com/kiwitcms/Kiwi/commit/d364ec47ec5a77b98bad2ab702b0406075a0e081
    label: security-advisories@github.com
  - url: 'https://github.com/kiwitcms/Kiwi/pull/4364'
    label: security-advisories@github.com
  - url: 'https://github.com/kiwitcms/Kiwi/releases/tag/v16.0'
    label: security-advisories@github.com
  - url: 'https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-v8rp-6xcv-fwgh'
    label: security-advisories@github.com
  - url: 'https://kiwitcms.org/blog/kiwi-tcms-team/2026/06/05/kiwi-tcms-160'
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-v8rp-6xcv-fwgh'
tags:
  - nvd
  - cve.org
  - ghsa
  - pip
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-17T19:11:03.451229Z'
ecosystem: pip
ingestedAt: '2026-07-02T21:44:45.088Z'
epss: 0.00439
epssPercentile: 0.35454
---

## Overview

Kiwi TCMS is an open source test management system. Prior to 16.0, the unauthenticated /init-db/ page handled by InitDBView in tcms/core/views.py remains reachable after initial setup and proxies repeated requests to Kiwi/manage.py migrate. The migration command is reentrant, so repeated access reports that no migrations are available and does not cause data loss, alter application state, reveal confidential information, or produce a documented availability impact. This issue is fixed in version 16.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-49292)

Affected packages:

- `kiwitcms <= 12.4`

Source: https://github.com/advisories/GHSA-v8rp-6xcv-fwgh