Every CVE Search/ Get API key

CVE-2023-30544

Kiwi TCMS may allow user to update email address to unverified one

3.9 LowFix available

Kiwi TCMS is an open source test management system. In versions of Kiwi TCMS prior to 12.2, users were able to update their email addresses via the My profile admin page. This page allowed them to change the email address registered with their account without the ownership verification performed during account registration. Operators of Kiwi TCMS should upgrade to v12.2 or later to receive a patch. No known workarounds exist.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.42%Up 0.4 points since Apr 25, 2023
90%50%10%1%

What each source reports

CVE List Score used 3.9

Kiwi TCMS may allow user to update email address to unverified one

Kiwi TCMS is an open source test management system. In versions of Kiwi TCMS prior to 12.2, users were able to update their email addresses via the My profile admin page. This page allowed them to change the email address registered with their account without the ownership verification performed during account registration. Operators of Kiwi TCMS should upgrade to v12.2 or later to receive a patch. No known workarounds exist.

Record
CVE-2023-30544
CVSS 3.1
3.9 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Weakness
CWE-283, CWE-863
Updated
2026-11-02
EUVDEUVD-2023-1233 3.9

Kiwi TCMS is an open source test management system. In versions of Kiwi TCMS prior to 12.2, users were able to update their email addresses via the My profile admin page. This page allowed them to change the email address registered with their account without the ownership verification performed during account registration. Operators of Kiwi TCMS should upgrade to v12.2 or later to receive a patch. No known workarounds exist.

Record
EUVD-2023-1233
CVSS 3.1
3.9 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-7x6q-3v3m-cwjg 0.0

kiwi TCMS has possibility for user to update email address to unverified one

Impact

In previous versions of Kiwi TCMS users were able to update their email addresses via the "My profile" admin page. This page allowed them to change the email address registered with their account without the ownership verification performed during account registration.

Patches

With Kiwi TCMS v12.2 or later it is not possible to edit the email field associated with a user account!

Workarounds

No workaround exists.

References

Disclosed by @novemberdad.

Record
GHSA-7x6q-3v3m-cwjg
CVSS 3.1
0.0 NoneCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N
Weakness
CWE-283, CWE-863
Updated
2026-11-02
NVD 3.9

Kiwi TCMS is an open source test management system. In versions of Kiwi TCMS prior to 12.2, users were able to update their email addresses via the My profile admin page. This page allowed them to change the email address registered with their account without the ownership verification performed during account registration. Operators of Kiwi TCMS should upgrade to v12.2 or later to receive a patch. No known workarounds exist.

Record
CVE-2023-30544
CVSS 3.1
3.9 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-283, CWE-863
Updated
2026-11-02
OSV 3.9

Kiwi TCMS may allow user to update email address to unverified one

Kiwi TCMS is an open source test management system. In versions of Kiwi TCMS prior to 12.2, users were able to update their email addresses via the My profile admin page. This page allowed them to change the email address registered with their account without the ownership verification performed during account registration. Operators of Kiwi TCMS should upgrade to v12.2 or later to receive a patch. No known workarounds exist.

Record
CVE-2023-30544
CVSS 3.1
3.9 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Weakness
CWE-283, CWE-863
Updated
2026-11-02
OSVGHSA-7x6q-3v3m-cwjg 0.0

kiwi TCMS has possibility for user to update email address to unverified one

Impact

In previous versions of Kiwi TCMS users were able to update their email addresses via the "My profile" admin page. This page allowed them to change the email address registered with their account without the ownership verification performed during account registration.

Patches

With Kiwi TCMS v12.2 or later it is not possible to edit the email field associated with a user account!

Workarounds

No workaround exists.

References

Disclosed by @novemberdad.

Record
GHSA-7x6q-3v3m-cwjg
CVSS 3.1
0.0 NoneCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N
Weakness
CWE-283, CWE-863
Updated
2026-11-02
OSVPYSEC-2026-1497 0.0

kiwi TCMS has possibility for user to update email address to unverified one

Impact

In previous versions of Kiwi TCMS users were able to update their email addresses via the "My profile" admin page. This page allowed them to change the email address registered with their account without the ownership verification performed during account registration.

Patches

With Kiwi TCMS v12.2 or later it is not possible to edit the email field associated with a user account!

Workarounds

No workaround exists.

References

Disclosed by @novemberdad.

Record
PYSEC-2026-1497
CVSS 3.1
0.0 NoneCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
kiwitcms
PyPI
 before 12.2
12.2
kiwitcms
PyPI
 before 12.2, plus listed versions
10.010.110.210.310.3.999
Show 41 moreShow less
10.410.511.011.111.311.411.511.611.712.012.16.106.116.2.16.36.46.56.5.36.66.76.86.97.07.17.27.2.17.38.08.18.1.998.28.38.48.58.68.6.18.78.88.99.09.999
12.2

History

History
RecordedChangedSources
aliases, products, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-30544 is a low vulnerability (CVSS 3.9) in Kiwitcms Kiwi, published April 24, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.42%, the 36th percentile. Fixed in kiwitcms 12.2.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open