rootpwn

medium · CVSS v4 6.9 · EPSS 0.00048

CVE-2026-49292

Kiwi TCMS prior to version 16.0 contains an unauthenticated endpoint at /init-db/ that remains accessible post-installation. This view proxi

Overview

Kiwi TCMS prior to version 16.0 contains an unauthenticated endpoint at /init-db/ that remains accessible post-installation. This view proxies repeated requests to the internal database migration management command. While reentrant and currently lacking documented availability or data loss impact, exposing database management functionality to unauthenticated users increases the attack surface.

Description

Kiwi TCMS is an open source test management system. Prior to 16.0, the unauthenticated /init-db/ page handled by InitDBView in tcms/core/views.py remains reachable after initial setup and proxies repeated requests to Kiwi/manage.py migrate. The migration command is reentrant, so repeated access reports that no migrations are available and does not cause data loss, alter application state, reveal confidential information, or produce a documented availability impact. This issue is fixed in version 16.0.

Impact

This vulnerability impacts the integrity and availability domains by exposing administrative database management routines to unauthenticated network users. Although the migration command is reentrant and does not immediately cause data corruption or loss in this specific context, unauthorized invocation can lead to unnecessary resource consumption or potential state changes. Organizations running unpatched instances of Kiwi TCMS are directly exposed.

Remediation

Upgrade Kiwi TCMS to version 16.0 or later where the unauthenticated /init-db/ endpoint is properly restricted. If upgrading immediately is not possible, implement network-level access controls or web application firewall rules to restrict access to the /init-db/ path.

Risk context

The vulnerability carries a CVSS v4 score of 6.9 (Medium) and a very low EPSS score of 0.00048, indicating a moderate technical severity with minimal observed exploitation activity. Despite the low immediate probability of exploitation, remediation is recommended to prevent unauthorized administrative actions.

Affected products

  • Kiwi TCMS < 16.0

Scores

Severity
medium
CVSS v2
—
CVSS v3
—
CVSS v4
6.9
EPSS
0.00048

Kiwi TCMS Authentication Bypass Access Control Web Application Medium Severity

← All CVEs

Related CVEs

medium

CVE-2026-93312

A null pointer dereference in Poppler 26.07.0’s JBIG2Stream::rewind can be triggered remotely, causing a crash in PDF rendering. The flaw is limited to the Poppler library and does not directly expose data. Updating to 26.08.0 mitigates the issue.

View analysis

medium

CVE-2026-18441

The LatePoint Appointment Booking plugin for WordPress (v5.6.9 and earlier) contains an insecure direct object reference that allows unauthenticated users to enumerate customer records when guest checkout is enabled. Attackers can retrieve first name, last name, email, and phone number for any customer ID. This flaw exposes personally identifiable information without requiring authentication.

View analysis

medium

CVE-2026-2585

Brizy – Page Builder for WordPress has a stored cross-site scripting flaw in the rootAttributes parameter through version 2.8.14. Authenticated users with Contributor-level access or higher can inject scripts that run when visitors view affected pages. This matters because it can compromise site visitors and weaken trust in the WordPress site.

View analysis

medium

CVE-2026-93308

CVE-2026-93308 affects the VES Collector component of O-RAN-SC SMO OAM 2025-06-10. A remote attacker can manipulate an unknown functionality to trigger resource allocation, potentially exhausting system resources. The vulnerability is publicly known but no patch has been released yet.

View analysis