CVE-2026-64822 Details

A user enumeration vulnerability has been identified in djangoSIGE versions through 1.10 (commit a6fe7e8). The issue resides in the ForgotPasswordView within djangosige/apps/login/views.py. This vulnerability allows unauthenticated attackers to identify valid accounts by analyzing the different error messages returned by the password reset endpoint. Attackers can send arbitrary usernames or email addresses to the POST login/esqueceu/ endpoint and differentiate between existing and non-existing accounts based on the discrepancies in the application's responses.

The vulnerability has been addressed by modifying the ForgotPasswordView to ensure that both existing and non-existing accounts return the same generic message, regardless of account status. Internal errors are now logged server-side instead of being exposed to the requester.