p PatchFirst

CVE-2026-49292

CVE-2026-49292 · Kiwi TCMS: The /init-db/ page renders and responds to requests after first use

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

Kiwi TCMS is an open source test management system. Prior to 16.0, the unauthenticated /init-db/ page handled by InitDBView in tcms/core/views.py remains reachable after initial setup and proxies repeated requests to Kiwi/manage.py migrate. The migration command is reentrant, so repeated access reports that no migrations are available and does not cause data loss, alter application state, reveal confidential information, or produce a documented availability impact. This issue is fixed in version 16.0.

CVSS 0.0 · Baja · EPSS 0,4%

Publicación
Actualización

Pila tecnológica: python

Productos y versiones afectados

  • kiwi

    Versiones
    • < 16.0: Afectada

    Sin corrección publicada

  • kiwitcms PyPI

    Versiones
    • 10.0
    • 10.1
    • 10.2
    • 10.3
    • 10.3.999
    • 10.4
    • 10.5
    • 11.0
    • 11.1
    • 11.3
    • 11.4
    • 11.5
    • 11.6
    • 11.7
    • 12.0
    • 12.1
    • 12.2
    • 12.3
    • 12.4
    • 6.10
    • 6.11
    • 6.2.1
    • 6.3
    • 6.4
    • 6.5
    • 6.5.3
    • 6.6
    • 6.7
    • 6.8
    • 6.9
    • 7.0
    • 7.1
    • 7.2
    • 7.2.1
    • 7.3
    • 8.0
    • 8.1
    • 8.1.99
    • 8.2
    • 8.3
    • 8.4
    • 8.5
    • 8.6
    • 8.6.1
    • 8.7
    • 8.8
    • 8.9
    • 9.0
    • 9.999
    Intervalos de versiones afectados
    • ECOSYSTEM: ≤ 12.4

    Sin corrección publicada

Fuentes originales

Comprueba tu servidor →