GitHub Advisoryadvisory · NuGet

GHSA-4g8m-5mj5-c8xg Umbraco Makes User Enumeration Feasible Based on Timing of Login Response

MEDIUM Published 2025-05-06 Modified 2025-05-06 Official page ↗
Aliases
CVE-2025-46736
Ecosystem
NuGet
Packages
Umbraco.Cms
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-204
Reviewed
2025-05-06

Affected packages

• NuGet Umbraco.Cms: >= 11.0.0-rc1, < 13.8.1 → fixed in 13.8.1 • NuGet Umbraco.Cms: < 10.8.10 → fixed in 10.8.10

Description

Impact Based on an analysis of the timing of post login API responses, it's possible to determine whether an account exists. Patches Patched in 10.8.10 and 13.8.1. Workarounds None available.

Related

Alias · CVE (1)

  • CVE-2025-46736 Umbraco is a free and open source .NET content management system. vulnerability

Weakness · CWE (1)

  • CWE-204 Observable Response Discrepancy weakness

References