The djangoSIGE application (up to version 1.10) has a user enumeration vulnerability in the ForgotPasswordView located in djangosige/apps/login/views.py. Attackers can exploit this by sending POST requests to the login/esqueceu/ endpoint with arbitrary usernames or email addresses. The application returns distinct error messages depending on whether the account exists, enabling attackers to identify valid accounts without authentication. This information disclosure can aid further targeted attacks. There is no vendor advisory or patch available at this time.

An attacker can confirm the existence of user accounts on the affected djangoSIGE application by analyzing the differing error responses from the password reset endpoint. This user enumeration can facilitate social engineering, credential stuffing, or brute force attacks by narrowing down valid targets. The vulnerability does not require authentication and has a medium severity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing uniform error messages on the password reset endpoint to prevent user enumeration. Avoid revealing whether a username or email exists in the system in response messages.