Kiwi TCMS CVE-2026-49292

LOW

Missing Authorization (CWE-862)

2026-07-02 https://github.com/kiwitcms/Kiwi

GHSA-v8rp-6xcv-fwgh

Authentication Bypass

Severity by source

vuln.today AI

5.3 MEDIUM

Network-accessible, unauthenticated endpoint (AV:N, PR:N) with no confidentiality or integrity impact; A:L reflects minor resource consumption from triggering idempotent database operations.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 21:24 vuln.today

DescriptionCVE.org

Kiwi TCMS provides the /init-db/ page as part of its setup mechanism for administrators who prefer a browser instead of the command line. In previous versions of Kiwi TCMS this page still renders and responds to requests even after first use.

Impact

The /init-db/ page does not require any user authentication because it is the first setup operation that needs to be executed in order for Kiwi TCMS to function. Database initialization happens before there are any user accounts available!

While that looks serious at first the /init-db/ page is merely a proxy behind the /Kiwi/manage.py migrate command, which itself is designed to be reentrant. In the case of repeated access to the /init-db/ page after first use the output is:

Running migrations:
  No migrations to apply.

as shown on the screenshots below:

There is no data loss because migrations result in a no-op if they are already applied!
No application state is altered because all state changes have already been applied!
No confidential information revealed because database migrations only report status on migrations which are clearly visible in source code!

Remediation

The /init-db/ page has been modified to short-circuit itself if migrations have already been applied, resulting in a no-op on the webUI layer as well.

AnalysisAI

Kiwi TCMS exposes its /init-db/ database setup endpoint without authentication even after initial setup is complete, allowing any unauthenticated remote actor to invoke the Django migration runner against an already-initialized database. Despite the Authentication Bypass classification (CWE-862), real-world impact is severely limited because the underlying manage.py migrate command is idempotent - once migrations are applied, repeated invocations produce a confirmed no-op with no data loss, no state change, and no information disclosure. No public exploit code exists and no CVSS score was assigned, consistent with the vendor's own characterization that the severity is low.

Technical ContextAI

Kiwi TCMS is a Django-based open-source test case management system distributed as a Python pip package (pkg:pip/kiwitcms). The /init-db/ endpoint wraps Django's manage.py migrate command in a browser-accessible UI to simplify initial setup for administrators who prefer GUI over CLI. CWE-862 (Missing Authorization) applies because the page intentionally omits authentication - it must function before any user accounts exist in the system. The critical mitigating factor is Django's migration framework design: the migrate command is explicitly reentrant, and calling it on an already-initialized schema outputs 'No migrations to apply' and exits cleanly without modifying any data, dropping tables, resetting sequences, or altering application state.

RemediationAI

Upgrade Kiwi TCMS to the patched release that modifies the /init-db/ endpoint to short-circuit and return immediately when database migrations have already been applied, making the endpoint a no-op at the web UI layer as well. The exact patched version number is not independently confirmed in the available advisory data - consult the GitHub Security Advisory at https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-v8rp-6xcv-fwgh and the kiwitcms/Kiwi release tags to identify the correct target version. As a compensating control prior to patching, configure a reverse proxy (nginx, Apache, or a cloud WAF) to block or return 403 on requests to the /init-db/ path from any source other than trusted administrative IP ranges; this eliminates external exposure but does not protect against internal threat actors on the same network segment.