EUVD-2026-46407
GHSA-92g2-rghg-v947
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network endpoint, no interaction required, impact limited to low confidentiality disclosure via account enumeration with no integrity or availability consequence.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
djangoSIGE through 1.10 (commit a6fe7e8) contains a user enumeration vulnerability in ForgotPasswordView within djangosige/apps/login/views.py that allows unauthenticated attackers to identify valid accounts by observing distinct error messages returned by the password reset endpoint. Attackers can submit arbitrary usernames or email addresses to the POST login/esqueceu/ endpoint and distinguish between existing and non-existing accounts based on observable discrepancies in the application's responses.
AnalysisAI
User enumeration in djangoSIGE through version 1.10 exposes valid account identities to unauthenticated remote attackers via the POST login/esqueceu/ password reset endpoint. The ForgotPasswordView returned distinct error messages depending on account state - 'not found in database,' 'user has no email registered,' or a success message - allowing systematic harvesting of valid usernames and email addresses. A publicly available proof-of-concept exploit exists; no CISA KEV listing at time of analysis.
Technical ContextAI
djangoSIGE is an open-source Django-based ERP (Sistema Integrado de Gestão Empresarial) developed by thiagopena, identified by CPE cpe:2.3:a:thiagopena:djangosige:*:*:*:*:*:*:*:*. The vulnerability is rooted in CWE-203 (Observable Discrepancy): the ForgotPasswordView class-based view in djangosige/apps/login/views.py conditionally returned distinct user-facing error strings based on whether the queried username or email existed in the database, whether the matched account had an email registered, and whether the reset email sent successfully. The PR #163 fix eliminates the discrepancy by replacing all conditional branches with a single generic Portuguese-language response ('Se este e-mail/usuário estiver cadastrado em nossa base, você receberá um e-mail com instruções para redefinir sua senha.'), logging exceptions server-side without exposing them to the requester.
RemediationAI
Apply the upstream fix from GitHub PR #163 (https://github.com/thiagopena/djangoSIGE/pull/163), which modifies ForgotPasswordView to return a single generic success message in all code paths regardless of whether the submitted username or email matches an account. This eliminates the observable discrepancy at the source. A released patched package version has not been independently confirmed - only the PR commit is available at time of analysis; administrators should apply the patch manually by updating djangosige/apps/login/views.py from the PR diff. As a compensating control, implementing rate-limiting or CAPTCHA on the POST login/esqueceu/ endpoint significantly raises the cost of automated enumeration (trade-off: adds friction for legitimate users). Restricting unauthenticated access to the password reset endpoint via network controls or authentication middleware fully mitigates the exposure where operationally acceptable. The VulnCheck advisory is available at https://www.vulncheck.com/advisories/djangosige-user-enumeration-via-forgotpasswordview.
More in Djangosige
View allSame weakness CWE-203 – Observable Discrepancy
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today