CVE-2026-64822

MEDIUM 5.3

djangoSIGE 1.10 User Enumeration via ForgotPasswordView

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

djangoSIGE through 1.10 (commit a6fe7e8) contains a user enumeration vulnerability in ForgotPasswordView within djangosige/apps/login/views.py that allows unauthenticated attackers to identify valid accounts by observing distinct error messages returned by the password reset endpoint. Attackers can submit arbitrary usernames or email addresses to the POST login/esqueceu/ endpoint and distinguish between existing and non-existing accounts based on observable discrepancies in the application's responses.

CWE	CWE-203
Vendor	thiagopena
Product	djangosige
Published	Jul 21, 2026

Stay Ahead of the Next One

Get instant alerts for thiagopena djangosige

Be the first to know when new medium vulnerabilities affecting thiagopena djangosige are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

thiagopena / djangoSIGE

0 ≤ 1.10 0 ≤ a6fe7e8e3a7d52ba0a25305df4e5e7e0cd5f5792

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/americooo/pentest-writeups/tree/main/djangoSIGE-CVE-2026-64821-64822 github.com: https://github.com/thiagopena/djangoSIGE/pull/163 vulncheck.com: https://www.vulncheck.com/advisories/djangosige-user-enumeration-via-forgotpasswordview

Credits

Amirbek Raxmatullayev