GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
Common Weakness Enumeration

CWE-204

Allowed

Observable Response Discrepancy

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.

341 vulnerabilities reference this CWE, most recent first.

GHSA-PC73-RJ2C-WVF9

Vulnerability from github – Published: 2026-01-01 06:30 – Updated: 2026-01-02 15:52
VLAI
Summary
Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists
Details

In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "code.gitea.io/gitea"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.25.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-69413"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-204"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-02T15:52:49Z",
    "nvd_published_at": "2026-01-01T05:16:03Z",
    "severity": "MODERATE"
  },
  "details": "In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists.",
  "id": "GHSA-pc73-rj2c-wvf9",
  "modified": "2026-01-02T15:52:49Z",
  "published": "2026-01-01T06:30:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69413"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/issues/35984"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/pull/36002"
    },
    {
      "type": "WEB",
      "url": "https://blog.gitea.com/release-of-1.25.2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/go-gitea/gitea"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/releases/tag/v1.25.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Gitea\u0027s /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists"
}

GHSA-PFJX-QRVM-2H2R

Vulnerability from github – Published: 2023-07-06 21:14 – Updated: 2024-04-04 05:45
VLAI
Details

Teltonika’s Remote Management System versions prior to 4.10.0 contain a function that allows users to claim their devices. This function returns information based on whether the serial number of a device has already been claimed, the MAC address of a device has already been claimed, or whether the attempt to claim a device was successful. An attacker could exploit this to create a list of the serial numbers and MAC addresses of all devices cloud-connected to the Remote Management System.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-32346"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-204"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-05-22T15:15:09Z",
    "severity": "MODERATE"
  },
  "details": "\nTeltonika\u2019s Remote Management System versions prior to 4.10.0 contain a function that allows users to claim their devices. This function returns information based on whether the serial number of a device has already been claimed, the MAC address of a device has already been claimed, or whether the attempt to claim a device was successful. An attacker could exploit this to create a list of the serial numbers and MAC addresses of all devices cloud-connected to the Remote Management System.\n\n",
  "id": "GHSA-pfjx-qrvm-2h2r",
  "modified": "2024-04-04T05:45:22Z",
  "published": "2023-07-06T21:14:59Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32346"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-08"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-PHCR-V9CH-26R8

Vulnerability from github – Published: 2026-03-13 21:31 – Updated: 2026-04-17 15:31
VLAI
Details

Observable response discrepancy vulnerability in OpenText™ Vertica allows Password Brute Forcing.   The vulnerability could lead to Password Brute Forcing in Vertica management console application.This issue affects Vertica: from 10.0 through 10.X, from 11.0 through 11.X, from 12.0 through 12.X.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
5.1 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/S:N/AU:Y/R:U
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-12455"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-204"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-13T19:53:47Z",
    "severity": "MODERATE"
  },
  "details": "Observable response discrepancy vulnerability in OpenText\u2122 Vertica allows Password Brute Forcing.\u00a0\u00a0\nThe vulnerability could lead to Password Brute Forcing in Vertica management console application.This issue affects Vertica: from 10.0 through 10.X, from 11.0 through 11.X, from 12.0 through 12.X.",
  "id": "GHSA-phcr-v9ch-26r8",
  "modified": "2026-04-17T15:31:06Z",
  "published": "2026-03-13T21:31:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12455"
    },
    {
      "type": "WEB",
      "url": "https://portal.microfocus.com/s/article/KM000045854?language=en_US"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-PV44-GXJV-57J6

Vulnerability from github – Published: 2026-07-13 18:30 – Updated: 2026-07-13 18:30
VLAI
Details

Rejetto HFS 3.0.0 through 3.2.0 returns observably different responses from its login endpoint depending on whether the submitted username exists. A remote unauthenticated attacker can use this to confirm valid account names, including the default admin account, facilitating password-guessing and session-forgery attacks.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-61503"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-204"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-13T18:16:30Z",
    "severity": "MODERATE"
  },
  "details": "Rejetto HFS 3.0.0 through 3.2.0 returns observably different responses from its login endpoint depending on whether the submitted username exists. A remote unauthenticated attacker can use this to confirm valid account names, including the default admin account, facilitating password-guessing and session-forgery attacks.",
  "id": "GHSA-pv44-gxjv-57j6",
  "modified": "2026-07-13T18:30:54Z",
  "published": "2026-07-13T18:30:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61503"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rejetto/hfs/releases/tag/v3.2.1"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/rejetto-hfs-username-enumeration-via-login-response-differences"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-PVM5-9FRX-264R

Vulnerability from github – Published: 2026-01-15 18:17 – Updated: 2026-01-21 16:55
VLAI
Summary
Zitadel has a user enumeration vulnerability in Login UIs
Details

Summary

A user enumeration vulnerability has been discovered in Zitadel's login interfaces. An unauthenticated attacker can exploit this flaw to confirm the existence of valid user accounts by iterating through usernames and userIDs.

Impact

The login UIs (in version 1 and 2) provide the possibility to request a password reset, where an email will be sent to the user with a link to a verification endpoint. By submitting arbitrary userIDs to these endpoints, an attacker can differentiate between valid and invalid accounts based on the system's response.

For an effective exploit the attacker needs to iterate through the potential set of userIDs. The impact can be limited by implementing rate limiting or similar measures to limit enumeration of userIDs.

Additionally, Zitadel includes a security feature "Ignoring unknown usernames", designed to prevent username enumeration attacks by presenting a generic response for both valid and invalid usernames on the login page. The login UI V2 did not handle the setting correctly and would allow attackers to enumerate through usernames to check their existence.

Affected Versions

All versions within the following ranges, including release candidates (RCs), are affected: - v4.x: 4.0.0 through 4.9.0 - 3.x: 3.0.0 through 3.4.5 - 2.x: 2.0.0 through 2.71.19

Patches

The vulnerability has been addressed in the latest releases. The patch resolves the issue by returning a generic error message, which does not indicate it the user exists.

4.x: Upgrade to >=4.9.1 3.x: Update to >=3.4.6 2.x: Update to >=3.4.6

Workarounds

The recommended solution is to update ZITADEL to a patched version. You can limit the impact by implementing rate limiting or similar measures to limit enumeration of userIDs.

There is no workaround for the "Ignoring unknown usernames" issue in login V2. Please upgrade to a patched version, if you rely on this feature.

Questions

If you have any questions or comments about this advisory, please email us at security@zitadel.com

Credits

Thanks to Niklas Kunz from Seamly for reporting this vulnerability from their pentest.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.9.0"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/zitadel/zitadel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.9.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.4.5"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/zitadel/zitadel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.4.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-23511"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-203",
      "CWE-204"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-15T18:17:06Z",
    "nvd_published_at": "2026-01-15T20:16:05Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nA user enumeration vulnerability has been discovered in Zitadel\u0027s login interfaces. An unauthenticated attacker can exploit this flaw to confirm the existence of valid user accounts by iterating through usernames and userIDs.\n\n### Impact\n\nThe login UIs (in version 1 and 2) provide the possibility to request a password reset, where an email will be sent to the user with a link to a verification endpoint.\nBy submitting arbitrary userIDs to these endpoints, an attacker can differentiate between valid and invalid accounts based on the system\u0027s response.\n\nFor an effective exploit the attacker needs to iterate through the potential set of userIDs. The impact can be limited by implementing [rate limiting](https://zitadel.com/docs/self-hosting/manage/production#limits-and-quotas) or similar measures to limit enumeration of userIDs.\n\nAdditionally, Zitadel includes a security feature \"Ignoring unknown usernames\", designed to prevent username enumeration attacks by presenting a generic response for both valid and invalid usernames on the login page. The login UI V2 did not handle the setting correctly and would allow attackers to enumerate through usernames to check their existence.\n\n### Affected Versions\n\nAll versions within the following ranges, including release candidates (RCs), are affected:\n- **v4.x**: `4.0.0` through `4.9.0`\n- **3.x**: `3.0.0` through `3.4.5`\n- **2.x**: `2.0.0` through `2.71.19`\n\n### Patches\n\nThe vulnerability has been addressed in the latest releases. The patch resolves the issue by returning a generic error message, which does not indicate it the user exists.\n\n4.x: Upgrade to \u003e=[4.9.1](https://github.com/zitadel/zitadel/releases/tag/v4.9.1)\n3.x: Update to \u003e=[3.4.6](https://github.com/zitadel/zitadel/releases/tag/v3.4.6)\n2.x: Update to \u003e=[3.4.6](https://github.com/zitadel/zitadel/releases/tag/v3.4.6)\n\n### Workarounds\n\nThe recommended solution is to update ZITADEL to a patched version. You can limit the impact by implementing [rate limiting](https://zitadel.com/docs/self-hosting/manage/production#limits-and-quotas) or similar measures to limit enumeration of userIDs.\n\nThere is no workaround for the \"Ignoring unknown usernames\" issue in login V2. Please upgrade to a patched version, if you rely on this feature.\n\n### Questions\n\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)\n\n### Credits\n\nThanks to Niklas Kunz from Seamly for reporting this vulnerability from their pentest.",
  "id": "GHSA-pvm5-9frx-264r",
  "modified": "2026-01-21T16:55:10Z",
  "published": "2026-01-15T18:17:06Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-pvm5-9frx-264r"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23511"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/commit/0bb00dd9fc4e5e965f8e14fa2161a5076f3c308d"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/commit/b85ab69e4679b0268e2b0e9b4cd04e934af10dd2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/commit/c300d4cc6a2775ab17ddfe76492f24170f8b858d"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/zitadel/zitadel"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/releases/tag/v3.4.6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/releases/tag/v4.9.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Zitadel has a user enumeration vulnerability in Login UIs"
}

GHSA-Q32W-QVCR-5JR4

Vulnerability from github – Published: 2026-07-14 03:31 – Updated: 2026-07-14 03:31
VLAI
Details

SAP HANA Database (user self service tools) allows an unauthenticated user to send specially crafted requests that produce distinguishable responses, enabling enumeration of valid user accounts and email addresses. Successful exploitation could allow the attacker to enumerate valid user accounts, resulting in low impact on confidentiality, with no impact on integrity and availability of the application.

Severity
3.7 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-44753"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-204"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-14T01:16:17Z",
    "severity": "LOW"
  },
  "details": "SAP HANA Database (user self service tools) allows an unauthenticated user to send specially crafted requests that produce distinguishable responses, enabling enumeration of valid user accounts and email addresses. Successful exploitation could allow the attacker to enumerate valid user accounts, resulting in low impact on confidentiality, with no impact on integrity and availability of the application.",
  "id": "GHSA-q32w-qvcr-5jr4",
  "modified": "2026-07-14T03:31:36Z",
  "published": "2026-07-14T03:31:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44753"
    },
    {
      "type": "WEB",
      "url": "https://me.sap.com/notes/3732522"
    },
    {
      "type": "WEB",
      "url": "https://url.sap/sapsecuritypatchday"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-Q387-RM8Q-3PR3

Vulnerability from github – Published: 2026-09-04 12:30 – Updated: 2026-09-04 12:30
VLAI
Details

Observable response discrepancy vulnerability in Menulux Software Inc. Menulux Portal allows Account Footprinting.

This issue affects Menulux Portal: before 20260903211448.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-19080"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-204"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-04T12:17:18Z",
    "severity": "HIGH"
  },
  "details": "Observable response discrepancy vulnerability in Menulux Software Inc. Menulux Portal allows Account Footprinting.\n\nThis issue affects Menulux Portal: before 20260903211448.",
  "id": "GHSA-q387-rm8q-3pr3",
  "modified": "2026-09-04T12:30:57Z",
  "published": "2026-09-04T12:30:57Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19080"
    },
    {
      "type": "WEB",
      "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0989"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-Q3QX-CP62-F6M7

Vulnerability from github – Published: 2025-12-02 00:38 – Updated: 2025-12-02 00:38
VLAI
Summary
Grav Admin Plugin vulnerable to User Enumeration & Email Disclosure
Details

Grav v1.7.49.5 / Admin v1.10.49.1 – User Enumeration & Email Disclosure

Summary

A user enumeration and email disclosure vulnerability exists in Grav v1.7.49.5 with Admin plugin v1.10.49.1.
The "Forgot Password" functionality at /admin/forgot leaks information about valid usernames and their associated email addresses through distinct server responses.
This allows an attacker to enumerate users and disclose sensitive email addresses, which can be leveraged for targeted attacks such as password spraying, phishing, or social engineering.

Details

The issue resides in the taskForgot() function, which handles the forgot password workflow.
Relevant vulnerable logic:

if (null === $user || $user->state !== 'enabled' || !$to) {
    ...
    // Generic message for invalid/non-existing users
    $this->setMessage($this->translate('PLUGIN_ADMIN.FORGOT_INSTRUCTIONS_SENT_VIA_EMAIL'));
    return $this->createRedirectResponse($current);
}

if ($rateLimiter->isRateLimited($username)) {
    ...
    $interval = $config->get('plugins.login.max_pw_resets_interval', 2);

    // Sensitive message for valid users
    $this->setMessage($this->translate('PLUGIN_LOGIN.FORGOT_CANNOT_RESET_IT_IS_BLOCKED', $to, $interval), 'error');

    return $this->createRedirectResponse($current);
}

When an attacker submits the password reset form at /admin/forgot with an invalid username, the application responds with: 

Instructions to reset your password have been sent to your email address

However, when a valid username is supplied, and the attacker repeatedly triggers password reset requests, the application responds with: 

Cannot reset password for <USER_EMAIL>, password reset functionality temporarily blocked, please try later (maximum 60 minutes)

This discrepancy in responses enables:
1. User Enumeration – Attackers can determine if a username exists in the system by analyzing the response.
2. User Email Disclosure – The system discloses the actual email address associated with the account (e.g., admin@localhost.test).

This violates best practices for authentication flows, where responses should remain generic to avoid leaking sensitive information.

PoC

  1. Navigate to the Forgot Password page: https://<target>/admin/forgot

  2. Submit a reset request with a random/invalid username (e.g., invalid_user):

  3. Response:
    Instructions to reset your password have been sent to your email address

  4. Submit a reset request with a valid username (e.g., admin).
  5. Repeatedly request a reset for the same username until the lockout mechanism triggers.
  6. Response:
    Cannot reset password for admin@localhost.test, password reset functionality temporarily blocked, please try later (maximum 60 minutes)
  7. Observe the leaked email address of the admin account in the error message.

Impact

  • Severity: Medium
  • Type: Information Disclosure / User Enumeration
  • Who is Impacted: All Grav sites using Admin plugin v1.10.49.1 with password reset enabled.
  • Risks:
  • Allows attackers to enumerate valid usernames.
  • Exposes email addresses of admin accounts, which can be used in:
  • Credential stuffing
  • Password spraying
  • Phishing/social engineering campaigns
  • Further exploitation in combination with other vulnerabilities

Recommendation

  • Modify the taskForgot() logic to always return a generic, non-identifying message, regardless of whether the username exists or rate limits are hit.

  • Example safe response: ini If the account exists, password reset instructions will be sent.

  • Do not include email addresses ($to) or other sensitive data in error messages.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "getgrav/grav"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.8.0-beta.27"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-66307"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-204"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-12-02T00:38:24Z",
    "nvd_published_at": "2025-12-01T22:15:50Z",
    "severity": "MODERATE"
  },
  "details": "# Grav v1.7.49.5 / Admin v1.10.49.1 \u2013 User Enumeration \u0026 Email Disclosure\n\n### Summary\nA **user enumeration and email disclosure vulnerability** exists in Grav **v1.7.49.5** with Admin plugin **v1.10.49.1**.  \nThe \"Forgot Password\" functionality at `/admin/forgot` leaks information about valid usernames and their associated email addresses through distinct server responses.  \nThis allows an attacker to enumerate users and disclose sensitive email addresses, which can be leveraged for targeted attacks such as password spraying, phishing, or social engineering.  \n\n### Details\n\nThe issue resides in the [`taskForgot()`](https://github.com/getgrav/grav-plugin-admin/blob/6d673fc7c4f6962756f93ae651371e81f7f20924/classes/plugin/Controllers/Login/LoginController.php#L349) function, which handles the forgot password workflow.  \nRelevant vulnerable logic:\n\n```php\nif (null === $user || $user-\u003estate !== \u0027enabled\u0027 || !$to) {\n    ...\n    // Generic message for invalid/non-existing users\n    $this-\u003esetMessage($this-\u003etranslate(\u0027PLUGIN_ADMIN.FORGOT_INSTRUCTIONS_SENT_VIA_EMAIL\u0027));\n    return $this-\u003ecreateRedirectResponse($current);\n}\n\nif ($rateLimiter-\u003eisRateLimited($username)) {\n    ...\n    $interval = $config-\u003eget(\u0027plugins.login.max_pw_resets_interval\u0027, 2);\n\n    // Sensitive message for valid users\n    $this-\u003esetMessage($this-\u003etranslate(\u0027PLUGIN_LOGIN.FORGOT_CANNOT_RESET_IT_IS_BLOCKED\u0027, $to, $interval), \u0027error\u0027);\n\n    return $this-\u003ecreateRedirectResponse($current);\n}\n```\n\nWhen an attacker submits the password reset form at `/admin/forgot` with an **invalid username**, the application responds with:  \n\n```\nInstructions to reset your password have been sent to your email address\n```\n\nHowever, when a **valid username** is supplied, and the attacker repeatedly triggers password reset requests, the application responds with:  \n\n```\nCannot reset password for \u003cUSER_EMAIL\u003e, password reset functionality temporarily blocked, please try later (maximum 60 minutes)\n```\n\nThis discrepancy in responses enables:  \n1. **User Enumeration** \u2013 Attackers can determine if a username exists in the system by analyzing the response.  \n2. **User Email Disclosure** \u2013 The system discloses the actual email address associated with the account (e.g., `admin@localhost.test`).  \n\nThis violates best practices for authentication flows, where responses should remain generic to avoid leaking sensitive information.\n\n### PoC\n1. Navigate to the **Forgot Password** page:  `https://\u003ctarget\u003e/admin/forgot`\n1. Submit a reset request with a random/invalid username (e.g., `invalid_user`):  \n\n- Response:  \n  ```\n  Instructions to reset your password have been sent to your email address\n  ```\n3. Submit a reset request with a valid username (e.g., `admin`).  \n4. Repeatedly request a reset for the same username until the lockout mechanism triggers.  \n- Response:  \n  ```\n  Cannot reset password for admin@localhost.test, password reset functionality temporarily blocked, please try later (maximum 60 minutes)\n  ```\n5. Observe the leaked **email address** of the admin account in the error message.  \n\n### Impact\n- **Severity:** Medium  \n- **Type:** Information Disclosure / User Enumeration  \n- **Who is Impacted:** All Grav sites using Admin plugin **v1.10.49.1** with password reset enabled.  \n- **Risks:**  \n  - Allows attackers to enumerate valid usernames.  \n  - Exposes email addresses of admin accounts, which can be used in:  \n  - Credential stuffing  \n  - Password spraying  \n  - Phishing/social engineering campaigns  \n  - Further exploitation in combination with other vulnerabilities  \n\n\n### Recommendation\n\n- Modify the [`taskForgot()`](https://github.com/getgrav/grav-plugin-admin/blob/6d673fc7c4f6962756f93ae651371e81f7f20924/classes/plugin/Controllers/Login/LoginController.php#L349) logic to always return a generic, non-identifying message, regardless of whether the username exists or rate limits are hit.\n\n- Example safe response:\n  ```ini\n  If the account exists, password reset instructions will be sent.\n  ```\n\n- Do not include email addresses ($to) or other sensitive data in error messages.",
  "id": "GHSA-q3qx-cp62-f6m7",
  "modified": "2025-12-02T00:38:24Z",
  "published": "2025-12-02T00:38:24Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/security/advisories/GHSA-q3qx-cp62-f6m7"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66307"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav-plugin-admin/commit/99f653296504f1d6408510dd2f6f20a45a26f9b0"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/getgrav/grav"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav-plugin-admin/blob/6d673fc7c4f6962756f93ae651371e81f7f20924/classes/plugin/Controllers/Login/LoginController.php#L349"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Grav Admin Plugin vulnerable to User Enumeration \u0026 Email Disclosure"
}

GHSA-Q4MQ-W4V3-MV77

Vulnerability from github – Published: 2024-03-07 21:30 – Updated: 2024-03-07 21:30
VLAI
Details

IBM DS8900F HMC 89.21.19.0, 89.21.31.0, 89.30.68.0, 89.32.40.0, and 89.33.48.0 could allow an authenticated user to arbitrarily read files after enumerating file names. IBM X-Force ID: 269407.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-46170"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-204"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-07T21:15:06Z",
    "severity": "MODERATE"
  },
  "details": "\nIBM DS8900F HMC 89.21.19.0, 89.21.31.0, 89.30.68.0, 89.32.40.0, and 89.33.48.0 could allow an authenticated user to arbitrarily read files after enumerating file names. IBM X-Force ID: 269407.\n\n",
  "id": "GHSA-q4mq-w4v3-mv77",
  "modified": "2024-03-07T21:30:21Z",
  "published": "2024-03-07T21:30:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46170"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/269407"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7130084"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-Q5P6-RX6M-VX4M

Vulnerability from github – Published: 2024-03-04 18:30 – Updated: 2024-03-04 18:30
VLAI
Details

IBM CICS TX Advanced 10.1 could disclose sensitive information to a remote attacker due to observable discrepancy in HTTP responses. IBM X-Force ID: 260814.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-38362"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-203",
      "CWE-204"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-04T16:15:49Z",
    "severity": "MODERATE"
  },
  "details": "IBM CICS TX Advanced 10.1 could disclose sensitive information to a remote attacker due to observable discrepancy in HTTP responses.  IBM X-Force ID:  260814.",
  "id": "GHSA-q5p6-rx6m-vx4m",
  "modified": "2024-03-04T18:30:35Z",
  "published": "2024-03-04T18:30:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38362"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/260814"
    },
    {
      "type": "WEB",
      "url": "https://https://www.ibm.com/support/pages/node/7066430"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation MIT-46
Architecture and Design

Strategy: Separation of Privilege

  • Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
  • Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Mitigation MIT-39
Implementation
  • Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or optimize their original attack, thereby increasing their chances of success.
  • If errors must be captured in some detail, record them in log messages, but consider what could occur if the log messages can be viewed by attackers. Highly sensitive information such as passwords should never be saved to log files.
  • Avoid inconsistent messaging that might accidentally tip off an attacker about internal state, such as whether a user account exists or not.
CAPEC-331: ICMP IP Total Length Field Probe

An adversary sends a UDP packet to a closed port on the target machine to solicit an IP Header's total length field value within the echoed 'Port Unreachable" error message. This type of behavior is useful for building a signature-base of operating system responses, particularly when error messages contain other types of information that is useful identifying specific operating system responses.

CAPEC-332: ICMP IP 'ID' Field Error Message Probe

An adversary sends a UDP datagram having an assigned value to its internet identification field (ID) to a closed port on a target to observe the manner in which this bit is echoed back in the ICMP error message. This allows the attacker to construct a fingerprint of specific OS behaviors.

CAPEC-541: Application Fingerprinting

An adversary engages in fingerprinting activities to determine the type or version of an application installed on a remote target.

CAPEC-580: System Footprinting

An adversary engages in active probing and exploration activities to determine security information about a remote target system. Often times adversaries will rely on remote applications that can be probed for system configurations.

← Back to the CWE list