The vulnerability resides in the file zinnia/views/mixins/entry_protection.py within the Fantomas42 django-blog-zinnia project and allows the cleartext storage of sensitive data. This flaw originates from improper handling of password protection, leading to the storage of credentials in an unencrypted form. The affected libraries may inadvertently expose passwords or other protected data if the file is accessed locally, potentially resulting in credential compromise and unauthorized access to protected content.

Fantomas42’s django-blog-zinnia releases up to 0.20 are affected. The flaw is tied to the Protected Entry Password Handler component, and any deployment of these versions that utilizes local entry protection exposes the risk of storing passwords in a readable form.

The CVSS score of 4.8 places the issue in the moderate severity range, but the EPSS score of less than 1% indicates a low probability of exploitation at present. The vulnerability requires local access, meaning that an attacker must have at least local read or execution privileges to trigger the flaw. While the weakness has not entered the CISA KEV catalog, the cleartext storage of sensitive information aligns with CWE-312 and poses a significant confidentiality threat if locally accessed credentials are leaked.