djangoSIGE 1.10 User Enumeration via ForgotPasswordView
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-203.
Summary
djangoSIGE through 1.10 (commit a6fe7e8) contains a user enumeration vulnerability in ForgotPasswordView within djangosige/apps/login/views.py that allows unauthenticated attackers to identify valid accounts by observing distinct error messages returned by the password reset endpoint. Attackers can submit arbitrary usernames or email addresses to the POST login/esqueceu/ endpoint and distinguish between existing and non-existing accounts based on observable discrepancies in the application's responses.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| thiagopena | djangoSIGE | up to 1.10 | — | No fix listed | CNA |
- djangoSIGE Vendorthiagopena Affected up to 1.10 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-64822
- 2026-10-03 Alias added: GHSA-92g2-rghg-v947
References
Exploit 1
Other 1
More thiagopena vulnerabilities
- TI-2026-46346 djangoSIGE 1.10 CSRF via GET-based Order Cancellation Views CVSS 4.0MEDIUM 5.3
Sources
- CVE-2026-64822 · CVE Program
- CVE-2026-64822 · NVD
- FIRST EPSS
- GHSA-92g2-rghg-v947 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences