CVE-2026-64822: djangoSIGE Information Disclosure Flaw

CVE-2026-64822 Overview

CVE-2026-64822 is a user enumeration vulnerability in djangoSIGE through version 1.10 (commit a6fe7e8). The flaw resides in the ForgotPasswordView class within djangosige/apps/login/views.py. The password reset endpoint returns distinct error messages depending on whether a submitted username or email exists in the database. Unauthenticated attackers can send crafted POST requests to the login/esqueceu/ endpoint and correlate the responses to enumerate valid accounts. The issue is categorized as an observable discrepancy weakness [CWE-203].

Critical Impact
Unauthenticated attackers can enumerate valid usernames and email addresses through the password reset endpoint, enabling targeted credential-based attacks against confirmed accounts.

Affected Products

djangoSIGE through version 1.10
djangoSIGE commit a6fe7e8 and prior revisions
The ForgotPasswordView component in djangosige/apps/login/views.py

Discovery Timeline

2026-07-21 - CVE-2026-64822 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-64822

Vulnerability Analysis

The vulnerability exists in the password reset workflow of djangoSIGE, an open-source Django-based ERP application. When a user submits a username or email address to the login/esqueceu/ endpoint, the ForgotPasswordView handler queries the user database and returns different response content depending on whether the account exists. An attacker can iterate through candidate usernames or email addresses and classify each as valid or invalid based on the observable response discrepancy. This behavior violates the security principle that authentication-adjacent endpoints should return uniform responses regardless of account existence.

Root Cause

The root cause is an observable response discrepancy [CWE-203] in the ForgotPasswordView implementation. The view returns distinct error messages for existing accounts versus non-existing accounts instead of returning a generic confirmation message in all cases. This side-channel leakage exposes account state to unauthenticated requesters. The upstream pull request 163 in the thiagopena/djangoSIGE repository addresses the disclosure by standardizing the response returned by the password reset flow.

Attack Vector

Exploitation requires no authentication and no user interaction. An attacker sends a POST request to the login/esqueceu/ endpoint with a candidate username or email value in the request body. The response content indicates whether the account exists. By scripting the request against a wordlist of usernames or a leaked email dataset, an attacker can compile a list of confirmed valid accounts. These confirmed accounts become high-value targets for credential stuffing, password spraying, and phishing campaigns. See the GitHub PenTest Writeup for a reproduction procedure.

Detection Methods for CVE-2026-64822

Indicators of Compromise

High volumes of POST requests to the login/esqueceu/ endpoint originating from a single IP address or narrow IP range within a short time window.
Sequential submissions containing enumerated usernames or emails drawn from common wordlists or breach corpora.
Web server access logs showing repeated 200-response password reset requests without corresponding follow-up reset token consumption.

Detection Strategies

Implement request-rate baselining on the login/esqueceu/ route and alert when submission volume exceeds normal user behavior.
Correlate password reset submissions with subsequent login or reset-completion events, then flag sources with high submission-to-completion ratios.
Inspect web application firewall logs for automated User-Agent strings and missing referrer headers targeting the password reset endpoint.

Monitoring Recommendations

Log every request to login/esqueceu/ with source IP, submitted identifier hash, and response signature for later analysis.
Deploy anomaly detection on authentication-adjacent endpoints and integrate the events into centralized SIEM pipelines.
Track distribution of unique identifiers submitted per source IP over rolling time windows to surface enumeration behavior.

How to Mitigate CVE-2026-64822

Immediate Actions Required

Apply the fix from Pull Request 163 in the djangoSIGE repository or update ForgotPasswordView to return an identical response for all submissions regardless of account existence.
Deploy rate limiting and CAPTCHA challenges on the login/esqueceu/ endpoint to slow automated enumeration attempts.
Review historical web server logs for prior enumeration activity and treat any identified accounts as targeted for follow-on attacks.

Patch Information

At the time of publication, no tagged upstream release supersedes version 1.10. Administrators should apply the code changes from Pull Request 163 directly to the deployed source tree. Additional context is available in the VulnCheck Security Advisory.

Workarounds

Modify ForgotPasswordView in djangosige/apps/login/views.py to return a single generic message such as "If the account exists, reset instructions have been sent."
Place the password reset endpoint behind a reverse proxy that enforces per-IP request quotas and blocks known enumeration User-Agents.
Restrict access to the djangoSIGE instance through VPN or IP allow-listing until the code fix is applied in production.

bash

# Nginx rate limiting example for the password reset endpoint
limit_req_zone $binary_remote_addr zone=pwreset:10m rate=5r/m;

location /login/esqueceu/ {
    limit_req zone=pwreset burst=3 nodelay;
    proxy_pass http://djangosige_upstream;
}