CVE-2026-64822

MediumCVSS 5.3

Published: 21/07/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

Vulnerability in djangoSIGE up to version 1.10 (commit a6fe7e8) allowing user enumeration via the password reset endpoint. An unauthenticated attacker can distinguish existing accounts from non-existing ones based on different error messages.

Risk Assessment

Risk of identifying valid user accounts, which could facilitate brute-force or phishing attacks on the system.

Recommendation

Update djangoSIGE to the latest version and unify error messages for the password reset endpoint.

Other vulnerabilities in djangoSIGE

CVE-2026-64821Medium
CSRF vulnerability in djangoSIGE up to version 1.10 allows unauthenticated attackers to cancel sales or purchase orders on behalf of authenticated users. The attack uses GET methods in cancellation views, bypassing CSRF protection.

Original NVD description (English source)

djangoSIGE through 1.10 (commit a6fe7e8) contains a user enumeration vulnerability in ForgotPasswordView within djangosige/apps/login/views.py that allows unauthenticated attackers to identify valid accounts by observing distinct error messages returned by the password reset endpoint. Attackers can submit arbitrary usernames or email addresses to the POST login/esqueceu/ endpoint and distinguish between existing and non-existing accounts based on observable discrepancies in the application's responses.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS