---
id: CVE-2026-64822
title: djangoSIGE 1.10 User Enumeration via ForgotPasswordView
summary: >-
  djangoSIGE through 1.10 (commit a6fe7e8) contains a user enumeration
  vulnerability in ForgotPasswordView within djangosige/apps/login/views.py that
  allows unauthenticated attackers to identify valid accounts by observing
  distinct error m…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-203
vendor: thiagopena
product: djangoSIGE
affected:
  - djangoSIGE <= 1.10
  - djangoSIGE <= a6fe7e8e3a7d52ba0a25305df4e5e7e0cd5f5792
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-07-22T14:29:23.847634Z'
exploitAvailable: true
published: '2026-07-21'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:07:59.256Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-64822'
references:
  - url: >-
      https://github.com/americooo/pentest-writeups/tree/main/djangoSIGE-CVE-2026-64821-64822
    label: Researcher Disclosure
  - url: 'https://github.com/thiagopena/djangoSIGE/pull/163'
    label: Pull Request
  - url: >-
      https://www.vulncheck.com/advisories/djangosige-user-enumeration-via-forgotpasswordview
tags:
  - cve.org
  - exploit-available
epss: 0.00424
epssPercentile: 0.36925
ingestedAt: '2026-11-08T14:51:22.269Z'
---

## Overview

djangoSIGE through 1.10 (commit a6fe7e8) contains a user enumeration vulnerability in ForgotPasswordView within djangosige/apps/login/views.py that allows unauthenticated attackers to identify valid accounts by observing distinct error messages returned by the password reset endpoint. Attackers can submit arbitrary usernames or email addresses to the POST login/esqueceu/ endpoint and distinguish between existing and non-existing accounts based on observable discrepancies in the application's responses.

## Affected

- `djangoSIGE <= 1.10`
- `djangoSIGE <= a6fe7e8e3a7d52ba0a25305df4e5e7e0cd5f5792`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.