Executive brief
Kiwi TCMS, a test case management system, contains a configuration page that remains accessible to anyone on the network even after the initial setup is complete. While this page is intended for first-time database setup, it does not require a password. However, the practical risk is very low because the page only triggers database updates that have already been completed, resulting in no data loss, unauthorized access to sensitive information, or changes to the application's state.
Technical details
A missing authorization vulnerability (CWE-862) exists in Kiwi TCMS where the '/init-db/' endpoint remains active and accessible to unauthenticated users after the initial database setup. The endpoint serves as a web-based wrapper for the 'manage.py migrate' command. Because Django migrations are designed to be reentrant, subsequent requests to this page by an attacker result in a 'No migrations to apply' message. The impact is limited to a minor integrity concern at the UI layer, as no application state is altered and no confidential data is exposed. The vulnerability has been addressed by modifying the endpoint to short-circuit and return a no-op if migrations have already been applied.
Affected products
- Kiwi TCMS kiwitcms <= 12.4
Timeline
- 2026-06-04: disclosed: Initial disclosure by reporter
- 2026-07-02: advisory: GitHub Advisory published