What is CVE-2026-64822?

CVE-2026-64822 is a medium-severity vulnerability in Thiagopena Djangosige, classified under Observable Discrepancy. CVSS score: 5.3/10. Published 2026-07-21.

How severe is CVE-2026-64822?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Vulnerability in Thiagopena Djangosige

CVE-2026-64822

djangoSIGE through 1.10 (commit a6fe7e8) contains a user enumeration vulnerability in ForgotPasswordView within djangosige/apps/login/views.py that allows unauthenticated attackers to identify valid accounts by observing distinct error messages returned by the password reset endpoint. Attackers can submit arbitrary usernames or email addresses to the POST login/esqueceu/ endpoint and distinguish between existing and non-existing accounts based on observable discrepancies in the application's responses.

EPSS: 0.004 (35.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

Affected products

Thiagopena Djangosige — versions 0

Weakness classification (CWE)

CWE-203 — Observable Discrepancy

References

disclosure@vulncheck.com (technical-description, exploit)
disclosure@vulncheck.com (issue-tracking)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-64822?: CVE-2026-64822 is a medium-severity vulnerability in Thiagopena Djangosige, classified under Observable Discrepancy. CVSS score: 5.3/10. Published 2026-07-21.
How severe is CVE-2026-64822?: Medium severity. CVSS v3 base score is 5.3 out of 10.