Kiwi TCMS: The /init-db/ page renders and responds to requests after first use
cve-program · CVE-2026-49292
PublishedKiwi TCMS is an open source test management system. Prior to 16.0, the unauthenticated /init-db/ page handled by InitDBView in tcms/core/views.py remains reachable after initial setup and proxies repeated requests to Kiwi/manage.py migrate. The migration command is reentrant, so repeated access reports that no migrations are available and does not cause data loss, alter application state, reveal confidential information, or produce a documented availability impact. This issue is fixed in version 16.0.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-49292 · CVE overview and exploitation status
cve-program · CVE-2026-49292
- https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-v8rp-6xcv-fwgh
- https://github.com/kiwitcms/Kiwi/pull/4364
- https://github.com/kiwitcms/Kiwi/commit/d364ec47ec5a77b98bad2ab702b0406075a0e081
- https://github.com/kiwitcms/Kiwi/releases/tag/v16.0
- https://kiwitcms.org/blog/kiwi-tcms-team/2026/06/05/kiwi-tcms-160
Related changes
Linked by CVE identifierNo related changes are available here.