The vulnerability in djangoSIGE 1.10 allows unauthenticated attackers to determine whether a username or email address exists by comparing distinct error messages from the ForgotPasswordView. By submitting arbitrary identifiers to the POST /login/esqueceu/ endpoint, an attacker learns which accounts are valid, which can aid credential stuffing, phishing, or targeted account compromise. This is an information-exposure weakness (CWE-203).

The issue affects the djangoSIGE application developed by thiagopena. All releases up to and including version 1.10 are vulnerable; any deployment running 1.10 or earlier is impacted. Upstream commits after a6fe7e8 contain the fix.

The CVSS score of 6.9 indicates moderate severity, and the EPSS score of less than 1% suggests this vulnerability is not widely exploited today. The vulnerability is accessible over the web without authentication, so any attacker who can reach the ForgotPasswordView endpoint can test user existence. It is not listed in the CISA KEV catalog, but the attack vector remains straightforward and the potential for upstream credential‑stuffing attacks warrants prompt mitigation.