umbraco/umbraco-cms · Security
Umbraco Makes User Enumeration Feasible Based on Timing of Login Response
- GHSA ID
- GHSA-4g8m-5mj5-c8xg
- CVE ID
- CVE-2025-46736
- Severity
- medium
- Published
- Updated
- CVSS
- 5.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- CVSS v3
- 5.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Description
Impact
Based on an analysis of the timing of post login API responses, it's possible to determine whether an account exists.
Patches
Patched in 10.8.10 and 13.8.1.
Workarounds
None available.
CWEs
- CWE-204 · Observable Response Discrepancy
References
- https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-4g8m-5mj5-c8xg ↗
- https://github.com/umbraco/Umbraco-CMS/commit/14fbd20665b453cbf094ccf4575b79a9fba07e03 ↗
- https://github.com/umbraco/Umbraco-CMS/commit/34709be6cce9752dfa767dffbf551305f48839bc ↗
- https://nvd.nist.gov/vuln/detail/CVE-2025-46736 ↗
- https://github.com/advisories/GHSA-4g8m-5mj5-c8xg ↗