# CWE-204.

Every Advisory and CVE whose sources give the weakness CWE-204, newest first.

## Records, newest first

- [SuiteCRM: V8 OAuth2 Username Enumeration](https://agentprime.io/advisories/CVE-2026-100362.md)
  `CVE-2026-100362` · CVE record: SuiteCRM SuiteCRM · CVSS 6.9 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: CWE-204
- [HomeBox: Timing Side-Channel in Login Endpoint Allows User Enumeration via Bcrypt Hashing Delay](https://agentprime.io/advisories/CVE-2026-85286.md)
  `CVE-2026-85286` · CVE record: sysadminsmedia homebox · CVSS 3.7 Low · Not analysed yet · Published 5 Nov 2026 · Tags: CWE-204, CWE-208
- [Open edX: Support "manage_course_team" REST API omits the \`require_support_permission\` gate its sibling support views enforce](https://agentprime.io/advisories/CVE-2026-97702.md)
  `CVE-2026-97702` · CVE record: openedx openedx-platform · CVSS 5.3 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control, CWE-204
- [blueprintUE Self-Hosted Edition before 4.3.3 Account Enumeration via Password Reset](https://agentprime.io/advisories/CVE-2026-122139.md)
  `CVE-2026-122139` · CVE record: blueprintue blueprintue-self-hosted-edition · CVSS 6.9 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: CWE-204
- [WPGraphQL before 2.24.2 Object Existence Disclosure via Media and Comment Mutations](https://agentprime.io/advisories/CVE-2026-119700.md)
  `CVE-2026-119700` · CVE record: WPGraphQL WPGraphQL · CVSS 6.9 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: CWE-204
- [User Enumeration in Rolantis Information Technologies' Agentis](https://agentprime.io/advisories/CVE-2026-100164.md)
  `CVE-2026-100164` · CVE record: Rolantis Information Technologies Tourism Industry and Trade Co. Ltd. Agentis · CVSS 7.5 High · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-204
- [Cacti: User Enumeration via Error Messages](https://agentprime.io/advisories/CVE-2026-49442.md)
  `CVE-2026-49442` · CVE record: Cacti cacti · CVSS 5.3 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-204
- [Username Enumeration via External User Stores in Multiple WSO2 Products Allows User Account Discovery](https://agentprime.io/advisories/CVE-2024-7478.md)
  `CVE-2024-7478` · CVE record: WSO2 WSO2 API Manager and 4 more · CVSS 5.8 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-204
- [FOSSBilling: Unauthenticated client account enumeration via guest signup endpoint](https://agentprime.io/advisories/CVE-2026-111056.md)
  `CVE-2026-111056` · CVE record: FOSSBilling FOSSBilling · CVSS 6.9 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Information disclosure, Authentication bypass, CWE-204
- [phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Account Enumeration via Guest Comment Endpoint](https://agentprime.io/advisories/CVE-2026-111887.md)
  `CVE-2026-111887` · CVE record: thorsten phpMyFAQ · CVSS 6.9 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: CWE-204
- [Guangzhou Juan IoT Technology EseeCloud Observable Response Discrepancy](https://agentprime.io/advisories/CVE-2026-105664.md)
  `CVE-2026-105664` · CVE record: Guangzhou Juan IoT Technology Co., Ltd. EseeCloud App and 1 more · CVSS 6.9 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: CWE-204
- [User Enumeration via Password Reset in IKAS Technology Inc.'s ikas E-Commerce Infrastructure](https://agentprime.io/advisories/CVE-2026-14177.md)
  `CVE-2026-14177` · CVE record: IKAS Technology Inc. ikas E-Commerce Infrastructure · CVSS 7.5 High · Not analysed yet · Published 16 Oct 2026 · Tags: CWE-204
- [Nezha 1.7.0 before 2.3.15 Cross-Tenant Server-ID Enumeration via getServerConfig](https://agentprime.io/advisories/CVE-2026-111386.md)
  `CVE-2026-111386` · CVE record: nezhahq nezha · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: CWE-204
- [OpenNMS REST authorization bypass via non-canonical HTTP method](https://agentprime.io/advisories/CVE-2026-111235.md)
  `CVE-2026-111235` · CVE record: The OpenNMS Group Meridian and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control, CWE-204
- [RSA PKCS#1 v1.5 padding oracle via legacy envelope key format downgrade in Amazon S3 Encryption Client for .NET](https://agentprime.io/advisories/CVE-2026-110310.md)
  `CVE-2026-110310` · CVE record: Amazon Amazon.Extensions.S3.Encryption · CVSS 6.0 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-204, CWE-757
- [CVE-2026-103526](https://agentprime.io/advisories/CVE-2026-103526.md)
  `CVE-2026-103526` · CVE record: Thelia Thelia · CVSS 3.7 Low · Not analysed yet · Published 12 Oct 2026 · Tags: CWE-204
- [LogicalDOC Community Edition through 9.3 Username Enumeration via AvatarServlet](https://agentprime.io/advisories/CVE-2026-109206.md)
  `CVE-2026-109206` · CVE record: LogicalDOC LogicalDOC Community Edition · CVSS 6.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: CWE-204
- [Contao: The registration module re-sends activation mails](https://agentprime.io/advisories/GHSA-mfxh-vp55-7gc6.md)
  `GHSA-mfxh-vp55-7gc6`, `CVE-2026-107843`, `PKSA-s71c-hg32-kv3f` · Packagist `contao/core-bundle`: affected `>=4.1.0, <5.3.50 || >=5.4.0-RC1, <5.7.12`, fixed in `5.3.50`, `5.7.12` · CVSS 5.3 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Denial of service, CWE-204
- [Hidden host credentials inferable via multiselect.get filtering](https://agentprime.io/advisories/CVE-2026-59785.md)
  `CVE-2026-59785` · CVE record: Zabbix Zabbix · CVSS 5.1 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-204
- [SiYuan: 17 block metadata/content endpoints in kernel/api/block.go have zero publish-access filtering, reachable by anonymous publish-mode readers](https://agentprime.io/advisories/GHSA-4vpg-gwqq-w44c.md)
  `GHSA-4vpg-gwqq-w44c`, `CVE-2026-74904`, `GO-2026-6654` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260804015139-bd067a4fe9b2`, fixed in `0.0.0-20260804015139-bd067a4fe9b2` · CVSS 8.7 High · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control, CWE-204
- [UTMStack < 11.2.16 Account Enumeration via Password Reset Endpoint](https://agentprime.io/advisories/CVE-2026-82043.md)
  `CVE-2026-82043` · CVE record: UTMStack UTMStack · CVSS 6.9 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: CWE-204
- [YesWiki before 4.6.7 User Enumeration via Lost-Password Flow](https://agentprime.io/advisories/CVE-2026-104439.md)
  `CVE-2026-104439` · CVE record: YesWiki yeswiki · CVSS 7.1 High · Not analysed yet · Published 2 Oct 2026 · Tags: CWE-204
- [Username Enumeration in Maksisoft Technology's Maksisoft Gym](https://agentprime.io/advisories/CVE-2026-86778.md)
  `CVE-2026-86778` · CVE record: Maksisoft Technology, IT, and Software Industry and Trade Inc. Maksisoft Gym · CVSS 5.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: CWE-204
- [Moodle: user list filters bypass profile field visibility](https://agentprime.io/advisories/CVE-2026-102587.md)
  `CVE-2026-102587` · CVE record · CVSS 2.7 Low · Not analysed yet · Published 30 Sept 2026 · Tags: CWE-204
- [Automation-controller: automation-controller: unauthenticated 200-vs-403 oracle in bitbucket data center webhook receiver enumerates webhook-enabled job templates](https://agentprime.io/advisories/CVE-2026-84717.md)
  `CVE-2026-84717` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-204
- [Automation-controller: automation-controller-container: automation-controller: custom_venv_path setting provides filesystem path-existence oracle on control pod](https://agentprime.io/advisories/CVE-2026-71462.md)
  `CVE-2026-71462` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 4.1 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-204
- [Automation-controller: automation-controller-container: automation-controller: named-url 404 body oracle enables cross-tenant resource name enumeration](https://agentprime.io/advisories/CVE-2026-71458.md)
  `CVE-2026-71458` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 5.0 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-204
- [Kingdom Communication Associated｜Smart Video Intercom System - Sensitive Data Exposure](https://agentprime.io/advisories/CVE-2026-89173.md)
  `CVE-2026-89173` · CVE record: Kingdom Communication Associated EH3040 and 3 more · CVSS 6.9 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: CWE-204
- [User Enumeration in DernekPlus' Website Template](https://agentprime.io/advisories/CVE-2026-9161.md)
  `CVE-2026-9161` · CVE record: DernekPlus Website Template · CVSS 5.3 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: CWE-204
- [Snipe-IT before 8.7.0 License Key Exposure via CSV Export](https://agentprime.io/advisories/CVE-2026-86758.md)
  `CVE-2026-86758` · CVE record: grokability snipe-it · CVSS 7.1 High · Not analysed yet · Published 9 Sept 2026 · Tags: CWE-204
- [User Enumeration in GastroMenum's GastroMenum Web Panel](https://agentprime.io/advisories/CVE-2026-19205.md)
  `CVE-2026-19205` · CVE record: GastroMenum GastroMenum Web Panel · CVSS 7.5 High · Not analysed yet · Published 4 Sept 2026 · Tags: CWE-204
- [Username Enumeration in Menulux Software's Menulux Portal](https://agentprime.io/advisories/CVE-2026-19080.md)
  `CVE-2026-19080` · CVE record: Menulux Software Inc. Menulux Portal · CVSS 7.5 High · Not analysed yet · Published 4 Sept 2026 · Tags: CWE-204
- [Observable Response Discrepancy in Kibana Leading to Cross-Space Information Disclosure](https://agentprime.io/advisories/CVE-2026-78584.md)
  `CVE-2026-78584` · CVE record: Elastic Kibana · CVSS 4.3 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: CWE-204
- [Filament: Password validity disclosure for accounts denied panel access on login page](https://agentprime.io/advisories/GHSA-xwpv-pqxp-5v36.md)
  `GHSA-xwpv-pqxp-5v36`, `CVE-2026-84307`, `PKSA-r2v2-7j3d-th1m` · Packagist `filament/filament`: affected `>=4.0.0, <4.12.5 || >=5.0.0, <5.7.5`, fixed in `4.12.5`, `5.7.5` · CVSS 3.7 Low · Not analysed yet · Published 1 Sept 2026 · Tags: CWE-204
- [Automatisch through 0.15.0 User Enumeration via Forgot-Password Response Discrepancy](https://agentprime.io/advisories/CVE-2026-81033.md)
  `CVE-2026-81033` · CVE record: automatisch automatisch · CVSS 6.9 Medium · Not analysed yet · Published 26 Aug 2026 · Tags: CWE-204
- [Rocket.Chat Missing DDP Rate Limit on the sendForgotPasswordEmail Meteor Method](https://agentprime.io/advisories/CVE-2026-75575.md)
  `CVE-2026-75575` · CVE record: RocketChat Rocket.Chat · CVSS 6.9 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Authentication bypass, CWE-204
- [Combodo iTop: User enumeration via password reset](https://agentprime.io/advisories/CVE-2026-27462.md)
  `CVE-2026-27462` · CVE record: Combodo iTop · CVSS 7.5 High · Not analysed yet · Published 21 Aug 2026 · Tags: CWE-204
- [Azure Stack HCI Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-69519.md)
  `CVE-2026-69519` · CVE record: Microsoft Azure Stack HCI · CVSS 8.6 High · Not analysed yet · Published 20 Aug 2026 · Tags: CWE-204
- [Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison](https://agentprime.io/advisories/GHSA-8fxq-53rx-ph5f.md)
  `GHSA-8fxq-53rx-ph5f`, `CVE-2026-111933`, `GO-2026-6265` · Go `github.com/coder/coder/v2`: affected `<2.29.17 || >=2.30.0, <2.32.7 || >=2.33.0, <2.33.8 || >=2.34.0, <2.34.2`, fixed in `2.29.17`, `2.32.7`, `2.33.8`, `2.34.2` · CVSS 6.3 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Information disclosure, CWE-204
- [Frappe: User Enumeration via PDDR](https://agentprime.io/advisories/CVE-2026-66002.md)
  `CVE-2026-66002` · CVE record: frappe frappe · CVSS 6.9 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: CWE-204
- [Lemmy: Login Endpoint User Enumeration via HTTP Response Code Differential](https://agentprime.io/advisories/CVE-2026-54739.md)
  `CVE-2026-54739` · CVE record: LemmyNet lemmy · CVSS 6.9 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: CWE-204
- [automad Password Reset Endpoint UserController.php requestPasswordResetToken response discrepancy](https://agentprime.io/advisories/CVE-2026-19965.md)
  `CVE-2026-19965` · CVE record: automad · CVSS 6.3 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: Information disclosure, CWE-204
- [PostgreSQL observable response discrepancy with non-default scram_iterations provides user existence oracle](https://agentprime.io/advisories/CVE-2026-14672.md)
  `CVE-2026-14672` · CVE record: PostgreSQL · CVSS 5.3 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: CWE-204
- [bluewave-labs Checkmate - User Enumeration via Differential HTTP Response in Password Recovery](https://agentprime.io/advisories/CVE-2026-72588.md)
  `CVE-2026-72588` · CVE record: bluewave-labs Checkmate · CVSS 5.3 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: CWE-204
- [Cluster Existence Oracle via Unauthenticated Import Endpoint](https://agentprime.io/advisories/CVE-2026-55998.md)
  `CVE-2026-55998` · CVE record: SUSE Rancher · CVSS 5.3 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: CWE-204
- [Ghost: Member existence leak via magic link sign-in response](https://agentprime.io/advisories/GHSA-chgm-3698-jm42.md)
  `GHSA-chgm-3698-jm42`, `BIT-ghost-2026-53947`, `CVE-2026-53947` · npm `ghost`: affected `>=5.18.0, <6.21.2`, fixed in `6.21.2` · CVSS 5.3 Medium · Not analysed yet · Published 4 Aug 2026 · Tags: CWE-204
- [Eclipse Foundation Eclipse Milo: In Eclipse Milo versions 0.6.0 through 1.1.4…](https://agentprime.io/advisories/CVE-2026-60007.md)
  `CVE-2026-60007` · CVE record: Eclipse Foundation Eclipse Milo · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Aug 2026 · Tags: CWE-204
- [Username Enumeration via Differential Login Responses in Bilin Software's HUMANIST Digital Human Resources](https://agentprime.io/advisories/CVE-2026-14202.md)
  `CVE-2026-14202` · CVE record: Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources · CVSS 5.3 Medium · Not analysed yet · Published 4 Aug 2026 · Tags: CWE-204
- [WPGraphQL has deprecated \`user\` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)](https://agentprime.io/advisories/GHSA-jhh7-832h-f8hv.md)
  `GHSA-jhh7-832h-f8hv`, `CVE-2026-54768`, `PKSA-2dkq-4nxk-nkts` · Packagist `wp-graphql/wp-graphql`: affected `<=2.6.0`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 31 Jul 2026 · Tags: CWE-204
- [Budibase: Account Enumeration via Login Lockout Response Differential](https://agentprime.io/advisories/GHSA-cr7p-cr3q-h5cm.md)
  `GHSA-cr7p-cr3q-h5cm`, `CVE-2026-73306` · npm `@budibase/server`: affected `<=3.38.1`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: CWE-204
- [XRDP is vulnerable to a server timing attack, leading to user enumeration](https://agentprime.io/advisories/CVE-2026-42218.md)
  `CVE-2026-42218` · CVE record: neutrinolabs xrdp · CVSS 5.3 Medium · Not analysed yet · Published 20 Jul 2026 · Tags: CWE-204
- [HCLSoftware Aftermarket EPC: HCL Aftermarket EPC is vulnerable to attack since It was found that a malicious actor can…](https://agentprime.io/advisories/CVE-2024-23574.md)
  `CVE-2024-23574` · CVE record: HCLSoftware Aftermarket EPC · CVSS 5.3 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: CWE-204
- [An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2.](https://agentprime.io/advisories/CVE-2026-47083.md)
  `CVE-2026-47083` · CVE record: cyrusimap Cyrus IMAP · CVSS 4.3 Medium · Not analysed yet · Published 16 Jul 2026 · Tags: CWE-204
- [Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle](https://agentprime.io/advisories/CVE-2026-15747.md)
  `CVE-2026-15747` · CVE record: SRI Mojolicious · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Jul 2026 · Tags: Cross-site request forgery (CSRF), CWE-204
- [Information Disclosure vulnerability in SAP HANA Extended Application Services classic model (User Self Service)](https://agentprime.io/advisories/CVE-2026-44753.md)
  `CVE-2026-44753` · CVE record: SAP_SE SAP HANA Extended Application Services classic model (User Self Service) · CVSS 3.7 Low · Not analysed yet · Published 14 Jul 2026 · Tags: CWE-204
- [Rejetto HFS < 3.2.1 Username Enumeration via Login Response Differences](https://agentprime.io/advisories/CVE-2026-61503.md)
  `CVE-2026-61503` · CVE record: rejetto hfs · CVSS 6.9 Medium · Not analysed yet · Published 13 Jul 2026 · Tags: CWE-204
- [Webauthn: SimpleFakeCredentialGenerator with an empty secret produces predictable fake credentials, weakening username enumeration protection](https://agentprime.io/advisories/GHSA-gq4g-fpc9-vjfq.md)
  `GHSA-gq4g-fpc9-vjfq`, `PKSA-zk1n-qbm6-d3rq` · Packagist `web-auth/webauthn-lib`: affected `>=4.9.0, <5.3.5`, fixed in `5.3.5` · CVSS 4.0, no score published · Not analysed yet · Published 7 Jul 2026 · Tags: Weak cryptography or TLS, CWE-204
- [SFTP REALPATH path-existence oracle allowing filesystem enumeration outside configured root](https://agentprime.io/advisories/CVE-2026-53422.md)
  `CVE-2026-53422` · CVE record: Erlang OTP · CVSS 2.3 Low · Not analysed yet · Published 2 Jul 2026 · Tags: CWE-204
- [User Enumeration in MCO](https://agentprime.io/advisories/CVE-2026-53908.md)
  `CVE-2026-53908` · CVE record: MyComplianceOffice MCO · CVSS 6.9 Medium · Not analysed yet · Published 1 Jul 2026 · Tags: CWE-204
- [Pterodactyl Panel: Client email change endpoint allows enumeration of accounts in system](https://agentprime.io/advisories/GHSA-j7f5-gfqm-pcx3.md)
  `GHSA-j7f5-gfqm-pcx3`, `PKSA-mzmz-41cv-9dtv` · Packagist `pterodactyl/panel`: affected `<1.12.3`, fixed in `1.12.3` · CVSS 4.0, no score published · Not analysed yet · Published 26 Jun 2026 · Tags: CWE-204

Older: <https://agentprime.io/advisories/tag/cwe-204.md?cursor=WyIyMDI2LTA2LTI2VDIwOjU0OjM4LjAwMDAwMFoiLCJHSFNBLWo3ZjUtZ2ZxbS1wY3gzIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-204>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-204/>. Everything for agents: <https://agentprime.io/llms.txt>.