CVE-2026-49292

Name of the Vulnerable Software and Affected Versions Kiwi TCMS (affected versions not specified)

Description The /init-db/ endpoint, used for initial database setup via a browser, remains accessible and responds to requests even after the initial setup is complete. This endpoint does not require authentication as it is intended for use before user accounts are created. The page acts as a proxy for the /Kiwi/manage.py migrate command, which is reentrant, meaning repeated executions do not alter the application state, cause data loss, or reveal confidential information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.