CVE-2026-64822

Katalog CVE

CVSS 5.3 · Medium EPSS 0,42%

Kerentanan Observable Discrepancy. Skor CVSS 3.1 5.3 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

djangoSIGE through 1.10 (commit a6fe7e8) contains a user enumeration vulnerability in ForgotPasswordView within djangosige/apps/login/views.py that allows unauthenticated attackers to identify valid accounts by observing distinct error messages returned by the password reset endpoint. Attackers can submit arbitrary usernames or email addresses to the POST login/esqueceu/ endpoint and distinguish between existing and non-existing accounts based on observable discrepancies in the application's responses.

Rincian

Terbit di NVD

21 Juli 2026

Terakhir diubah

23 Juli 2026

Status NVD

Deferred

CVSS 3.1

5.3 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-203: Observable Discrepancy

EPSS (30 hari)

0,42% peluang dieksploitasi; lebih tinggi dari 34,8% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/americooo/pentest-writeups/tree/main/djangoSIGE-CVE-2026-64821-64822
• https://github.com/thiagopena/djangoSIGE/pull/163
• https://www.vulncheck.com/advisories/djangosige-user-enumeration-via-forgotpasswordview