CWE-204.

SuiteCRM: V8 OAuth2 Username Enumeration

• SuiteCRM
• CWE-204

HomeBox: Timing Side-Channel in Login Endpoint Allows User Enumeration via Bcrypt Hashing Delay

• sysadminsmedia homebox
• CWE-204
• CWE-208

Open edX: Support "manage_course_team" REST API omits the `require_support_permission` gate its sibling support views enforce

• openedx-platform
• Broken access control
• CWE-204

blueprintUE Self-Hosted Edition before 4.3.3 Account Enumeration via Password Reset

• blueprintue-self-hosted-edition
• CWE-204

WPGraphQL before 2.24.2 Object Existence Disclosure via Media and Comment Mutations

• WPGraphQL
• CWE-204

User Enumeration in Rolantis Information Technologies' Agentis

• Rolantis Information Technologies Tourism Industry and Trade Co. Ltd. Agentis
• CWE-204

Cacti: User Enumeration via Error Messages

• cacti
• CWE-204

Username Enumeration via External User Stores in Multiple WSO2 Products Allows User Account Discovery

• WSO2 API Manager
• WSO2 Identity Server as Key Manager
• CWE-204

FOSSBilling: Unauthenticated client account enumeration via guest signup endpoint

• FOSSBilling
• Information disclosure
• Authentication bypass

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Account Enumeration via Guest Comment Endpoint

• thorsten phpMyFAQ
• CWE-204

Guangzhou Juan IoT Technology EseeCloud Observable Response Discrepancy

• Guangzhou Juan IoT Technology Co., Ltd. EseeCloud App
• Guangzhou Juan IoT Technology Co., Ltd. EseeCloud Firmware
• CWE-204

User Enumeration via Password Reset in IKAS Technology Inc.'s ikas E-Commerce Infrastructure

• IKAS Technology Inc. ikas E-Commerce Infrastructure
• CWE-204

Nezha 1.7.0 before 2.3.15 Cross-Tenant Server-ID Enumeration via getServerConfig

• nezha
• CWE-204

OpenNMS REST authorization bypass via non-canonical HTTP method

• The OpenNMS Group Meridian
• The OpenNMS Group Horizon
• Broken access control
• CWE-204

RSA PKCS#1 v1.5 padding oracle via legacy envelope key format downgrade in Amazon S3 Encryption Client for .NET

• Amazon.Extensions.S3.Encryption
• CWE-204
• CWE-757

CVE-2026-103526

• Thelia
• CWE-204

LogicalDOC Community Edition through 9.3 Username Enumeration via AvatarServlet

• LogicalDOC Community Edition
• CWE-204

Contao: The registration module re-sends activation mails

• Denial of service
• CWE-204

>=4.1.0, <5.3.50 || >=5.4.0-RC1, <5.7.12 · fixed in 5.3.50, 5.7.12

Hidden host credentials inferable via multiselect.get filtering

• Zabbix
• CWE-204

SiYuan: 17 block metadata/content endpoints in kernel/api/block.go have zero publish-access filtering, reachable by anonymous publish-mode readers

• Broken access control
• CWE-204

<0.0.0-20260804015139-bd067a4fe9b2 · fixed in 0.0.0-20260804015139-bd067a4fe9b2

UTMStack < 11.2.16 Account Enumeration via Password Reset Endpoint

• UTMStack
• CWE-204

YesWiki before 4.6.7 User Enumeration via Lost-Password Flow

• yeswiki
• CWE-204

Username Enumeration in Maksisoft Technology's Maksisoft Gym

• Maksisoft Technology, IT, and Software Industry and Trade Inc. Maksisoft Gym
• CWE-204

Moodle: user list filters bypass profile field visibility

• CWE-204

Automation-controller: automation-controller: unauthenticated 200-vs-403 oracle in bitbucket data center webhook receiver enumerates webhook-enabled job templates

• Red Hat Ansible Automation Platform 2.5 for RHEL 8
• Red Hat Ansible Automation Platform 2.5 for RHEL 9
• CWE-204

Automation-controller: automation-controller-container: automation-controller: custom_venv_path setting provides filesystem path-existence oracle on control pod

• Red Hat Ansible Automation Platform 2.5 for RHEL 8
• Red Hat Ansible Automation Platform 2.5 for RHEL 9
• CWE-204

Automation-controller: automation-controller-container: automation-controller: named-url 404 body oracle enables cross-tenant resource name enumeration

• Red Hat Ansible Automation Platform 2.5 for RHEL 8
• Red Hat Ansible Automation Platform 2.5 for RHEL 9
• CWE-204

Kingdom Communication Associated｜Smart Video Intercom System - Sensitive Data Exposure

• Kingdom Communication Associated EH3040
• Kingdom Communication Associated EH4200
• CWE-204

User Enumeration in DernekPlus' Website Template

• DernekPlus Website Template
• CWE-204

Snipe-IT before 8.7.0 License Key Exposure via CSV Export

• grokability snipe-it
• CWE-204

User Enumeration in GastroMenum's GastroMenum Web Panel

• GastroMenum Web Panel
• CWE-204

Username Enumeration in Menulux Software's Menulux Portal

• Menulux Software Inc. Menulux Portal
• CWE-204

Observable Response Discrepancy in Kibana Leading to Cross-Space Information Disclosure

• Elastic Kibana
• CWE-204

Filament: Password validity disclosure for accounts denied panel access on login page

• CWE-204

>=4.0.0, <4.12.5 || >=5.0.0, <5.7.5 · fixed in 4.12.5, 5.7.5

Automatisch through 0.15.0 User Enumeration via Forgot-Password Response Discrepancy

• automatisch
• CWE-204

Rocket.Chat Missing DDP Rate Limit on the sendForgotPasswordEmail Meteor Method

• RocketChat Rocket.Chat
• Authentication bypass
• CWE-204

Combodo iTop: User enumeration via password reset

• Combodo iTop
• CWE-204

Azure Stack HCI Information Disclosure Vulnerability

• Microsoft Azure Stack HCI
• CWE-204

Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison

• Information disclosure
• CWE-204

<2.29.17 || >=2.30.0, <2.32.7 || >=2.33.0, <2.33.8 || >=2.34.0, <2.34.2 · fixed in 2.29.17, 2.32.7, 2.33.8, 2.34.2

Frappe: User Enumeration via PDDR

• frappe
• CWE-204

Lemmy: Login Endpoint User Enumeration via HTTP Response Code Differential

• lemmy
• CWE-204

automad Password Reset Endpoint UserController.php requestPasswordResetToken response discrepancy

• automad
• Information disclosure
• CWE-204

PostgreSQL observable response discrepancy with non-default scram_iterations provides user existence oracle

• PostgreSQL
• CWE-204

bluewave-labs Checkmate - User Enumeration via Differential HTTP Response in Password Recovery

• bluewave-labs Checkmate
• CWE-204

Cluster Existence Oracle via Unauthenticated Import Endpoint

• SUSE Rancher
• CWE-204

Ghost: Member existence leak via magic link sign-in response

• CWE-204

>=5.18.0, <6.21.2 · fixed in 6.21.2

Eclipse Foundation Eclipse Milo: In Eclipse Milo versions 0.6.0 through 1.1.4…

• Eclipse Foundation Eclipse Milo
• CWE-204

Username Enumeration via Differential Login Responses in Bilin Software's HUMANIST Digital Human Resources

• Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources
• CWE-204

WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)

• CWE-204

<=2.6.0 · no fixed version yet

Budibase: Account Enumeration via Login Lockout Response Differential

• CWE-204

<=3.38.1 · no fixed version yet

XRDP is vulnerable to a server timing attack, leading to user enumeration

• neutrinolabs xrdp
• CWE-204

HCLSoftware Aftermarket EPC: HCL Aftermarket EPC is vulnerable to attack since It was found that a malicious actor can…

• HCLSoftware Aftermarket EPC
• CWE-204

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2.

• cyrusimap Cyrus IMAP
• CWE-204

Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle

• SRI Mojolicious
• Cross-site request forgery (CSRF)
• CWE-204

Information Disclosure vulnerability in SAP HANA Extended Application Services classic model (User Self Service)

• SAP_SE SAP HANA Extended Application Services classic model (User Self Service)
• CWE-204

Rejetto HFS < 3.2.1 Username Enumeration via Login Response Differences

• rejetto hfs
• CWE-204

Webauthn: SimpleFakeCredentialGenerator with an empty secret produces predictable fake credentials, weakening username enumeration protection

• Weak cryptography or TLS
• CWE-204

>=4.9.0, <5.3.5 · fixed in 5.3.5

SFTP REALPATH path-existence oracle allowing filesystem enumeration outside configured root

• Erlang OTP
• CWE-204

User Enumeration in MCO

• MyComplianceOffice MCO
• CWE-204

Pterodactyl Panel: Client email change endpoint allows enumeration of accounts in system

• CWE-204

<1.12.3 · fixed in 1.12.3