Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N N P N L N 5.3 .0015 4.7 —
AFFECTED Product Versions Fixed djangoSIGE unspecified —
TIMELINE Jul 20 Reserved by VulnCheck Jul 21 Published (CNA: VulnCheck) Jul 22 EXPLOIT PUBLISHED — CVE-2026-64821 (thiagopena djangoSIGE). Public exploit reference added.
djangoSIGE through 1.10 (commit a6fe7e8) contains a cross-site request forgery vulnerability that allows unauthenticated attackers to cancel sales or purchase orders on behalf of authenticated users by exploiting order-cancellation logic implemented inside HTTP GET method handlers in CancelarOrcamentoVendaView, CancelarPedidoVendaView, CancelarOrcamentoCompraView, and CancelarPedidoCompraView. Attackers can lure an authenticated victim with change_orcamentovenda or equivalent permissions to a page containing a cross-origin reference such as an img tag pointing to the cancellation endpoint, bypassing CSRF token validation entirely since Django's CsrfViewMiddleware only enforces CSRF checks on unsafe HTTP methods.
| Date | Event | Detail |
|---|---|---|
| July 20, 2026 | Reserved | Reserved by VulnCheck |
| July 21, 2026 | Published | Published (CNA: VulnCheck) |
| July 22, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-64821 (thiagopena djangoSIGE). Public exploit reference added. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| thiagopena | djangoSIGE | — | — | — |
Authoritative record: CVE-2026-64821 at cve.org
Vendors: thiagopena
Weaknesses: CWE-352
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-64821 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.