CVE-2025-46736CWE-204

Umbraco Makes User Enumeration Feasible Based on Timing of Login Response

Medium · published May 6, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
31.0
In the wild
Unconfirmed
What it is

Umbraco is a free and open source .NET content management system. Prior to versions 10.8.10 and 13.8.1, based on an analysis of the timing of post login API responses, it's possible to determine whether an account exists. The issue is patched in versions 10.8.10 and 13.8.1. No known workarounds are available.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00382 · 31.0th percentile
Weakness
CWE-204 · Observable Response Discrepancy
Published
2025-05-06T17:08Z
EPSS history
Timeline
  • 06 MAY 17:08Z
    Umbraco Makes User Enumeration Feasible Based on Timing of Login Response
    cvelistv5