CVE-2023-30544 Kiwi TCMS may allow user to update email address to unverified one

Low 3.9 Published 24 Apr 2023 Updated 4 Feb 2025

Attackers can bypass email verification to change account email addresses, potentially leading to account takeover in Kiwi TCMS.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2023-30544?

CVE-2023-30544 is a low-severity vulnerability in kiwitcms Kiwi, published on 24 Apr 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Kiwi TCMS is an open source test management system. In versions of Kiwi TCMS prior to 12.2, users were able to update their email addresses via the `My profile` admin page. This page allowed them to change the email address registered with their account without the ownership verification performed during account registration. Operators of Kiwi TCMS should upgrade to v12.2 or later to receive a patch. No known workarounds exist.

Weakness: CWE-863, CWE-283

Which versions are affected by CVE-2023-30544?

3 open source packages ship an affected version, including kiwitcms. It affects 1 product.

Package	Affected	Fixed in
`kiwitcms` PyPI	All versions	`12.2`
`kiwitcms` PyPI	All versions	`12.2`
`kiwitcms` PyPI	All versions	`12.2`

Products include Kiwitcms Kiwi Tcms.

How do I fix CVE-2023-30544?

Upgrade kiwitcms to 12.2 or later.

Is CVE-2023-30544 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-30544 exists.

Sources

Also known as GHSA-7x6q-3v3m-cwjg, PYSEC-2026-1497.