Description
Kiwi TCMS is an open source test management system. Prior to 16.0, the unauthenticated /init-db/ page handled by InitDBView in tcms/core/views.py remains reachable after initial setup and proxies repeated requests to Kiwi/manage.py migrate. The migration command is reentrant, so repeated access reports that no migrations are available and does not cause data loss, alter application state, reveal confidential information, or produce a documented availability impact. This issue is fixed in version 16.0.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
kiwitcms Kiwi
< 16.0affected
References
- https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-v8rp-6xcv-fwgh ↗
- https://github.com/kiwitcms/Kiwi/pull/4364 ↗
- https://github.com/kiwitcms/Kiwi/commit/d364ec47ec5a77b98bad2ab702b0406075a0e081 ↗
- https://github.com/kiwitcms/Kiwi/releases/tag/v16.0 ↗
- https://kiwitcms.org/blog/kiwi-tcms-team/2026/06/05/kiwi-tcms-160 ↗