CVE-2026-51788

CVE-2026-51788 is an uncontrolled resource consumption flaw (CWE-400) in cleverange_auth version 0.1.10, located in the account_verification function and the accounts/models.py component. A remote, unauthenticated attacker can trigger the issue through the account-verification path, causing resource exhaustion that disrupts service availability; the CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms high availability impact with no confidentiality or integrity impact. An attacker gains the ability to crash, hang, or otherwise deny service to the affected application, with no indication of code execution or data exposure. Affected parties are deployments running cleverange_auth 0.1.10; the accounts/models.py path suggests a Django-style (Python) codebase, though the advisory does not state a distribution channel or fixed version. No public proof-of-concept is known, the flaw is not in CISA's KEV, and EPSS assigns only a 0.5% probability of exploitation within 30 days (41st percentile), so no exploitation is currently known.

What to do: Inventory your environments (including Python dependency trees, given the models.py path) for cleverange_auth 0.1.10 and monitor the vendor/upstream channel for a patched release beyond 0.1.10, since no fixed version is specified in the advisory. Until a fix ships, reduce exposure by rate-limiting or restricting unauthenticated access to account-verification endpoints. With no known exploitation, no public PoC, and low EPSS, this can be prioritized behind actively exploited issues but should not be ignored if the package is deployed on internet-facing systems.