CVE-2026-49292— Kiwi TCMS: The /init-db/ page renders and responds to requests after first use
Quick assessment
Affected
kiwitcms Kiwi
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Kiwi TCMS 是一个开源的测试管理系统。在 16.0 版本之前，未认证的 页面（由 中的 处理）在初始设置完成后仍然可访问，并会将重复请求代理到 。由于迁移命令具有可重入性，重复访问时会报告没有可用的迁移，不会导致数据丢失、改变应用状态、泄露机密信息，也不会造成已记录的影响可用性的问题。该问题已在 16.0 版本中修复。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-49292
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Kiwi TCMS: The /init-db/ page renders and responds to requests after first use
Source: CVE Program / CVE List V5
Vulnerability Description
Kiwi TCMS is an open source test management system. Prior to 16.0, the unauthenticated /init-db/ page handled by InitDBView in tcms/core/views.py remains reachable after initial setup and proxies repeated requests to Kiwi/manage.py migrate. The migration command is reentrant, so repeated access reports that no migrations are available and does not cause data loss, alter application state, reveal confidential information, or produce a documented availability impact. This issue is fixed in version 16.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-49292
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-49292
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-49292 (2)
Vendor Advisories for CVE-2026-49292 (1)
Security Blog Posts for CVE-2026-49292 (1)
-
🔗 Kiwi TCMS - Kiwi TCMS 16.0 x_refsource_MISC
Vendor Pages for CVE-2026-49292 (1)
-
🔗 Release Kiwi TCMS 16.0 (05 Jun 2026) · kiwitcms/Kiwi · GitHub x_refsource_MISC
IV. Related Vulnerabilities
Same product: Kiwi
-
CVE-2026-55630
Kiwi TCMS: Stored XSS via javascript: URI in extra_link fiel -
CVE-2026-54724
Kiwi TCMS: Open Redirect via unvalidated next parameter in a -
CVE-2025-58790
WordPress Kiwi Plugin <= 2.1.8 - Cross Site Scripting (XSS) -
CVE-2023-36809
Kiwi TCMS's misconfigured HTTP headers allow stored XSS exec -
CVE-2023-33977
Stored cross site scripting (XSS) via unrestricted file uplo
Same vendor: kiwitcms
-
CVE-2026-55630
Kiwi TCMS: Stored XSS via javascript: URI in extra_link fiel -
CVE-2026-54724
Kiwi TCMS: Open Redirect via unvalidated next parameter in a -
CVE-2023-36809
Kiwi TCMS's misconfigured HTTP headers allow stored XSS exec -
CVE-2023-33977
Stored cross site scripting (XSS) via unrestricted file uplo -
CVE-2023-32686
kiwitcms vulnerable to stored XSS via unrestricted files upl
Same weakness: CWE-862
-
CVE-2026-54643
CubeCart: Missing Authorization Check for Order Note Deletio -
CVE-2026-54648
CubeCart: Missing Authorization Check in customers.gdpr.inc. -
CVE-2026-54519
AI Agent Automation: Missing ownership checks in memory APIs -
CVE-2026-16582
Booking for Appointments and Events Calendar - Amelia <= 2.4 -
CVE-2026-16750
Motors – Car Dealership & Classified Listings <= 1.4.120 - M
V. Comments for CVE-2026-49292
No comments yet