CVE-2026-49292 Kiwi TCMS: The /init-db/ page renders and responds to requests after first use
Unauthenticated users can access the database initialization page after setup, bypassing intended access controls, though no data loss or disclosure occurs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-49292?
CVE-2026-49292 is a missing authorization vulnerability in kiwitcms Kiwi, published on 17 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Kiwi TCMS is an open source test management system. Prior to 16.0, the unauthenticated /init-db/ page handled by InitDBView in tcms/core/views.py remains reachable after initial setup and proxies repeated requests to Kiwi/manage.py migrate. The migration command is reentrant, so repeated access reports that no migrations are available and does not cause data loss, alter application state, reveal confidential information, or produce a documented availability impact. This issue is fixed in version 16.0.
Weakness: CWE-862
Which versions are affected by CVE-2026-49292?
3 open source packages ship an affected version, including kiwitcms.
| Package | Affected | Fixed in |
|---|---|---|
kiwitcms PyPI | All versions to 12.4 | None |
kiwitcms PyPI | All versions to 12.4 | None |
kiwitcms PyPI | All versions to 12.4 | None |
How do I fix CVE-2026-49292?
No fix has been published for CVE-2026-49292 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-49292 being exploited?
There is no known exploitation of CVE-2026-49292 in the wild and no public exploit code.
Sources
Also known as GHSA-v8rp-6xcv-fwgh, PYSEC-2026-2553.