CVE-2026-16213
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk0th percentile - higher than 0% of all known CVEs
Summary
A vulnerability in django-blog-zinnia up to version 0.20 stores protected entry passwords in cleartext within the file zinnia/views/mixins/entry_protection.py. The issue affects the Protected Entry Password Handler component and requires local access to exploit. The project has not responded to the report.
Risk Assessment
The organization risks exposure of sensitive credentials, potentially leading to unauthorized access to protected content. The lack of vendor response leaves the vulnerability unaddressed.
Recommendation
Update django-blog-zinnia to the latest version immediately or apply a workaround by replacing cleartext storage with secure password hashing.
Original NVD description (English source)
A security flaw has been discovered in Fantomas42 django-blog-zinnia up to 0.20. Affected by this vulnerability is an unknown functionality of the file zinnia/views/mixins/entry_protection.py of the component Protected Entry Password Handler. The manipulation results in cleartext storage of sensitive information. The attack needs to be approached locally. The project was informed of the problem early through an issue report but has not responded yet.