CVE-2026-49292: Kiwi TCMS's /init-db/ page renders and responds to requests after first use

July 2, 2026

Kiwi TCMS provides the /init-db/ page as part of its setup mechanism for administrators who prefer a browser instead of the command line. In previous versions of Kiwi TCMS this page still renders and responds to requests even after first use.

References

github.com/advisories/GHSA-v8rp-6xcv-fwgh
github.com/kiwitcms/Kiwi/security/advisories/GHSA-v8rp-6xcv-fwgh
nvd.nist.gov/vuln/detail/CVE-2026-49292

Code Behaviors & Features

Detect and mitigate CVE-2026-49292 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →