CVE-2026-64822

djangoSIGE through 1.10 (commit a6fe7e8) contains a user enumeration vulnerability in ForgotPasswordView within djangosige/apps/login/views.py that allows unauthenticated attackers to identify valid accounts by observing distinct error messages returned by the password reset endpoint. Attackers can submit arbitrary usernames or email addresses to the POST login/esqueceu/ endpoint and distinguish between existing and non-existing accounts based on observable discrepancies in the application's responses.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/americooo/pentest-writeups/tree/main/djangoSIGE-CVE-2026-64821-64822
https://github.com/thiagopena/djangoSIGE/pull/163
https://www.vulncheck.com/advisories/djangosige-user-enumeration-via-forgotpasswordview

Configurations

No configuration.

History

24 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) djangoSIGE hasta la versión 1.10 (commit a6fe7e8) contiene una vulnerabilidad de enumeración de usuarios en ForgotPasswordView dentro de djangosige/apps/login/views.py que permite a atacantes no autenticados identificar cuentas válidas observando mensajes de error distintos devueltos por el endpoint de restablecimiento de contraseña. Los atacantes pueden enviar nombres de usuario o direcciones de correo electrónico arbitrarios al endpoint POST login/esqueceu/ y distinguir entre cuentas existentes y no existentes basándose en discrepancias observables en las respuestas de la aplicación.

Information

Published : 2026-07-21 21:16

Updated : 2026-10-24 19:10

NVD link : CVE-2026-64822

Mitre link : CVE-2026-64822

CVE.ORG link : CVE-2026-64822

JSON object : View

Products Affected

No product.

CWE

CWE-203

Observable Discrepancy

{"id": "CVE-2026-64822", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-64822", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-22T14:29:23.847634Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/thiagopena/djangoSIGE", "vendor": "thiagopena", "product": "djangoSIGE", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.10"}, {"status": "affected", "version": "0", "versionType": "git", "lessThanOrEqual": "a6fe7e8e3a7d52ba0a25305df4e5e7e0cd5f5792"}], "packageURL": "pkg:github/thiagopena/djangoSIGE", "defaultStatus": "affected"}]}], "published": "2026-07-21T21:16:53.640", "references": [{"url": "https://github.com/americooo/pentest-writeups/tree/main/djangoSIGE-CVE-2026-64821-64822", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/thiagopena/djangoSIGE/pull/163", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/djangosige-user-enumeration-via-forgotpasswordview", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-203"}]}], "descriptions": [{"lang": "en", "value": "djangoSIGE through 1.10 (commit a6fe7e8) contains a user enumeration vulnerability in ForgotPasswordView within djangosige/apps/login/views.py that allows unauthenticated attackers to identify valid accounts by observing distinct error messages returned by the password reset endpoint. Attackers can submit arbitrary usernames or email addresses to the POST login/esqueceu/ endpoint and distinguish between existing and non-existing accounts based on observable discrepancies in the application's responses."}, {"lang": "es", "value": "djangoSIGE hasta la versi\u00f3n 1.10 (commit a6fe7e8) contiene una vulnerabilidad de enumeraci\u00f3n de usuarios en ForgotPasswordView dentro de djangosige/apps/login/views.py que permite a atacantes no autenticados identificar cuentas v\u00e1lidas observando mensajes de error distintos devueltos por el endpoint de restablecimiento de contrase\u00f1a. Los atacantes pueden enviar nombres de usuario o direcciones de correo electr\u00f3nico arbitrarios al endpoint POST login/esqueceu/ y distinguir entre cuentas existentes y no existentes bas\u00e1ndose en discrepancias observables en las respuestas de la aplicaci\u00f3n."}], "lastModified": "2026-10-24T19:10:00.127", "sourceIdentifier": "disclosure@vulncheck.com"}