CVE-2026-49292

Kiwi TCMS is an open source test management system. Prior to 16.0, the unauthenticated /init-db/ page handled by InitDBView in tcms/core/views.py remains reachable after initial setup and proxies repeated requests to Kiwi/manage.py migrate. The migration command is reentrant, so repeated access reports that no migrations are available and does not cause data loss, alter application state, reveal confidential information, or produce a documented availability impact. This issue is fixed in version 16.0.

• CWE-862

• https://github.com/kiwitcms/Kiwi/commit/d364ec47ec5a77b98bad2ab702b0406075a0e081
• https://github.com/kiwitcms/Kiwi/pull/4364
• https://github.com/kiwitcms/Kiwi/releases/tag/v16.0
• https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-v8rp-6xcv-fwgh
• https://kiwitcms.org/blog/kiwi-tcms-team/2026/06/05/kiwi-tcms-160

Published

Sep 17, 2026

Last Modified

Sep 17, 2026

Status

Received

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-49287Statamic is a Laravel and Git powered content management sys…7.4
• CVE-2026-49288Statamic is a Laravel and Git powered content management sys…4.3
• CVE-2026-49289The SimpleSAMLphp SAML2 library is a PHP library for SAML2 r…7.5
• CVE-2026-4929Simple Hierarchical Select (SHS) for Drupal 7 contains cross…5.4
• CVE-2026-49290Slopsmith is a self-contained web application for browsing, …7.6
• CVE-2026-49291mcp-memory-service is a semantic memory layer for AI applica…8.1
• CVE-2026-49293js-toml is a TOML parser for JavaScript, fully compliant wit…7.5
• CVE-2026-49294Valhalla is an open source routing engine and accompanying l…6.1
• CVE-2026-49295libde265 is an open source implementation of the h.265 video…7.1
• CVE-2026-49296Before apache-airflow 3.3.0, a user authorized to read one D…6.5
• CVE-2026-49297Apache Airflow's Google provider operators `GCSToSFTPOperato…8.1
• CVE-2026-49298A bug in Apache Airflow's KubernetesExecutor caused JWT toke…8.8