{"items":[{"id":"NVI-00017512","kind":"vulnerability","title":"Kiwi TCMS's /init-db/ page renders and responds to requests after first use","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-v8rp-6xcv-fwgh","CVE-2026-49292"],"plain_summary":"GitHub lists this reviewed advisory for kiwitcms. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-10641b691b1316a3cd95f09d7f1b2daf"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-10641b691b1316a3cd95f09d7f1b2daf","url":"https://github.com/advisories/GHSA-v8rp-6xcv-fwgh","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-v8rp-6xcv-fwgh","publisher":"GitHub Advisory Database","observed_at":"2026-11-05T03:47:11.081Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-10641b691b1316a3cd95f09d7f1b2daf"],"technology":"kiwitcms","known_exclusions":[],"conditions_summary":"Kiwi TCMS provides the /init-db/ page as part of its setup mechanism for administrators who prefer a browser instead of the command line. In previous versions of Kiwi TCMS this page still renders and responds to requests even after first use.\n\n### Impact\n\nThe /init-db/ page does not require any user authentication because it is the first setup operation that needs to be executed in order for Kiwi TCMS to function. Database initialization happens before there are any user accounts available!\n\nWhile that looks serious at first the /init-db/ page is merely a proxy behind the `/Kiwi/manage.py migrate` command, which itself is designed to be reentrant. In the case of repeated access to the /init-db/ page after first use the output is:\n```\nRunning migrations:\n  No migrations to apply.\n```\nas shown on the screenshots below:\n\n\n\n\n\n- There is no data loss because migrations result in a no-op if they are already applied!\n- No applicatio","public_affected_ranges":["<= 12.4"]}],"null_published_at":"2026-11-05T19:10:21.401Z","source_updated_at":"2026-07-02T20:55:22.000Z","source_disclosed_at":"2026-07-02T20:55:22.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-05T03:47:11.081Z"}],"next_cursor":null,"snapshot_revision":"42594"}