Common Weakness Enumeration

CWE-204

Allowed

Observable Response Discrepancy

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.

367 vulnerabilities reference this CWE, most recent first.

GHSA-3XM3-C6M3-M8WF

Vulnerability from github – Published: 2025-10-14 03:30 – Updated: 2025-10-14 03:30
VLAI
Details

A vulnerability in SAP Financial Service Claims Management RFC function ICL_USER_GET_NAME_AND_ADDRESS allows user enumeration and potential disclosure of personal data through response discrepancies, causing low impact on confidentiality with no impact on integrity or availability.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-42903"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-204"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-10-14T01:15:32Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability in SAP Financial Service Claims Management RFC function ICL_USER_GET_NAME_AND_ADDRESS allows user enumeration and potential disclosure of personal data through response discrepancies, causing low impact on confidentiality with no impact on integrity or availability.",
  "id": "GHSA-3xm3-c6m3-m8wf",
  "modified": "2025-10-14T03:30:57Z",
  "published": "2025-10-14T03:30:57Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-42903"
    },
    {
      "type": "WEB",
      "url": "https://me.sap.com/notes/3656781"
    },
    {
      "type": "WEB",
      "url": "https://url.sap/sapsecuritypatchday"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-424X-CXVH-WQ9P

Vulnerability from github – Published: 2025-05-28 17:38 – Updated: 2025-05-28 20:08
VLAI
Summary
Mautic allows user name enumeration due to response time difference on password reset form
Details

Summary

This advisory addresses a security vulnerability in Mautic related to the "Forget your password" functionality. This vulnerability could be exploited by unauthenticated users to enumerate valid usernames.

User Enumeration via Timing Attack: A user enumeration vulnerability exists in the "Forget your password" functionality. Differences in response times for existing and non-existing users, combined with a lack of request limiting, allow an attacker to determine the existence of usernames through a timing-based attack.

Mitigation

Please update to a version that addresses this timing vulnerability, where password reset responses are normalized to respond at the same time regardless of user existence.

Workarounds

None

If you have any questions or comments about this advisory: Email us at security@mautic.org

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "mautic/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.0.0"
            },
            {
              "fixed": "4.4.16"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "mautic/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0-alpha"
            },
            {
              "fixed": "5.2.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "mautic/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.0.0-alpha"
            },
            {
              "fixed": "6.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-47057"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-203",
      "CWE-204"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-05-28T17:38:46Z",
    "nvd_published_at": "2025-05-28T18:15:25Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nThis advisory addresses a security vulnerability in Mautic related to the \"Forget your password\" functionality. This vulnerability could be exploited by unauthenticated users to enumerate valid usernames.\n\nUser Enumeration via Timing Attack: A user enumeration vulnerability exists in the \"Forget your password\" functionality. Differences in response times for existing and non-existing users, combined with a lack of request limiting, allow an attacker to determine the existence of usernames through a timing-based attack.\n\n### Mitigation\nPlease update to a version that addresses this timing vulnerability, where password reset responses are normalized to respond at the same time regardless of user existence.\n\n### Workarounds\nNone\n\nIf you have any questions or comments about this advisory:\nEmail us at security@mautic.org",
  "id": "GHSA-424x-cxvh-wq9p",
  "modified": "2025-05-28T20:08:12Z",
  "published": "2025-05-28T17:38:46Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/mautic/mautic/security/advisories/GHSA-424x-cxvh-wq9p"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47057"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mautic/mautic"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Mautic allows user name enumeration due to response time difference on password reset form"
}

GHSA-43QQ-QW4X-28F8

Vulnerability from github – Published: 2022-10-18 21:14 – Updated: 2026-01-31 03:41
VLAI
Summary
Kirby CMS vulnerable to user enumeration in the code-based login and password reset forms
Details

TL;DR

This vulnerability only affects you if you are using the code or password-reset auth method with the auth.methods option. It can only be successfully exploited under server configuration conditions outside of the attacker's control.

Introduction

User enumeration is a type of vulnerability that allows attackers to confirm which users are registered in a Kirby installation. This information can be abused for social engineering attacks against users of the site or to find out the organizational structure of the company.

User enumeration attacks are performed by entering an existing and a non-existing user into the email address field of the login form. If the system returns a different response or behaves differently depending on whether the user exists, the attacker can enter unknown email addresses and use the different behavior as a clue for the (non-)existing user.

Impact

Under normal circumstances, entering an invalid email address results in a "fake" login code form that looks exactly like the one of an existing user (unless debugging is enabled). However, the code that handles the creation of a code challenge (for code-based login or password reset) didn't catch errors that occurred while the challenge request was processed:

  • If the challenge itself runs into an error (e.g. if the email could not be sent), attackers could tell existing users (where the challenge code is called) from non-existing users (where the challenge code is not called and therefore does not output an error).
  • If you are using the user.login:failed hook and any exception is thrown within the hook, attackers could see that the user does not exist.

As long as no error occurs during challenge creation and during the processing of the user.login:failed hook, your Kirby sites are not affected by this vulnerability.

Patches

The problems have been patched in Kirby 3.5.8.2, Kirby 3.6.6.2, Kirby 3.7.5.1 and Kirby 3.8.1. Please update to one of these or a later version to fix the vulnerability.

All of the mentioned releases contain two patches for this vulnerability:

  • All errors that occur during the creation of an auth challenge (code-based login or password reset) are swallowed by the backend and only displayed to the user if debugging is enabled.
  • We added a new auth.debug option that can be enabled separately from the debug option. If disabled, auth errors are only printed to the PHP error log. This ensures that security-critical errors are only displayed if they are really necessary for debugging.

Workarounds

We recommend to update to one of the patch releases. If you cannot update immediately, you can work around the issue by setting the auth.methods option to password, which disables the code-based login and password reset forms.

However please note that your site will still be vulnerable against another user enumeration issue that was also fixed in the same patch releases.

Credits

Thanks to Florian Merz (@florianmrz) of hatchery.io for responsibly reporting the identified issue.

Severity
4.8 (Medium)
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "getkirby/cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.5.0"
            },
            {
              "fixed": "3.5.8.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "getkirby/cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.6.0"
            },
            {
              "fixed": "3.6.6.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "getkirby/cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.7.0"
            },
            {
              "fixed": "3.7.5.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "getkirby/cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.8.0"
            },
            {
              "fixed": "3.8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.8.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2022-39314"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-204",
      "CWE-307"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-10-18T21:14:04Z",
    "nvd_published_at": "2022-10-24T14:15:00Z",
    "severity": "MODERATE"
  },
  "details": "### TL;DR\n\nThis vulnerability only affects you if you are using the `code` or `password-reset` auth method with the `auth.methods` option. It can only be successfully exploited under server configuration conditions outside of the attacker\u0027s control.\n\n----\n\n### Introduction\n\nUser enumeration is a type of vulnerability that allows attackers to confirm which users are registered in a Kirby installation. This information can be abused for social engineering attacks against users of the site or to find out the organizational structure of the company.\n\nUser enumeration attacks are performed by entering an existing and a non-existing user into the email address field of the login form. If the system returns a different response or behaves differently depending on whether the user exists, the attacker can enter unknown email addresses and use the different behavior as a clue for the (non-)existing user.\n\n### Impact\n\nUnder normal circumstances, entering an invalid email address results in a \"fake\" login code form that looks exactly like the one of an existing user (unless debugging is enabled). However, the code that handles the creation of a code challenge (for code-based login or password reset) didn\u0027t catch errors that occurred while the challenge request was processed:\n\n- If the challenge itself runs into an error (e.g. if the email could not be sent), attackers could tell existing users (where the challenge code is called) from non-existing users (where the challenge code is not called and therefore does not output an error).\n- If you are using the `user.login:failed` hook and any exception is thrown within the hook, attackers could see that the user does not exist.\n\nAs long as no error occurs during challenge creation and during the processing of the `user.login:failed` hook, your Kirby sites are *not* affected by this vulnerability.\n\n### Patches\n\nThe problems have been patched in [Kirby 3.5.8.2](https://github.com/getkirby/kirby/releases/tag/3.5.8.2), [Kirby 3.6.6.2](https://github.com/getkirby/kirby/releases/tag/3.6.6.2), [Kirby 3.7.5.1](https://github.com/getkirby/kirby/releases/tag/3.7.5.1) and [Kirby 3.8.1](https://github.com/getkirby/kirby/releases/tag/3.8.1). Please update to one of these or a [later version](https://github.com/getkirby/kirby/releases) to fix the vulnerability.\n\nAll of the mentioned releases contain two patches for this vulnerability:\n\n- All errors that occur during the creation of an auth challenge (code-based login or password reset) are swallowed by the backend and only displayed to the user if debugging is enabled.\n- We added a new `auth.debug` option that can be enabled separately from the `debug` option. If disabled, auth errors are only printed to the PHP error log. This ensures that security-critical errors are only displayed if they are really necessary for debugging.\n\n### Workarounds\n\nWe recommend to update to one of the patch releases. If you cannot update immediately, you can work around the issue by setting the `auth.methods` option to `password`, which disables the code-based login and password reset forms.\n\nHowever please note that your site will still be vulnerable against [another user enumeration issue](https://github.com/getkirby/kirby/security/advisories/GHSA-c27j-76xg-6x4f) that was also fixed in the same patch releases.\n\n### Credits\n\nThanks to [Florian Merz](mailto:florian@hatchery.io) (@florianmrz) of [hatchery.io](https://www.hatchery.io/) for responsibly reporting the identified issue.",
  "id": "GHSA-43qq-qw4x-28f8",
  "modified": "2026-01-31T03:41:13Z",
  "published": "2022-10-18T21:14:04Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/getkirby/kirby/security/advisories/GHSA-43qq-qw4x-28f8"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39314"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/getkirby/kirby"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getkirby/kirby/releases/tag/3.5.8.2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getkirby/kirby/releases/tag/3.6.6.2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getkirby/kirby/releases/tag/3.7.5.1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getkirby/kirby/releases/tag/3.8.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Kirby CMS vulnerable to user enumeration in the code-based login and password reset forms"
}

GHSA-466P-J3VQ-MWQ3

Vulnerability from github – Published: 2025-01-25 15:30 – Updated: 2025-01-25 15:30
VLAI
Details

IBM Control Center 6.2.1 and 6.3.1

could allow a remote attacker to enumerate usernames due to an observable discrepancy between login attempts.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-35114"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-203",
      "CWE-204"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-25T14:15:29Z",
    "severity": "MODERATE"
  },
  "details": "IBM Control Center 6.2.1 and 6.3.1 \n\n\n\n\n\ncould allow a remote attacker to enumerate usernames due to an observable discrepancy between login attempts.",
  "id": "GHSA-466p-j3vq-mwq3",
  "modified": "2025-01-25T15:30:31Z",
  "published": "2025-01-25T15:30:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35114"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7174842"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-4C58-M4CG-6H2F

Vulnerability from github – Published: 2026-04-14 03:31 – Updated: 2026-04-14 03:31
VLAI
Details

During authorization checks in SAP Human Capital Management for SAP S/4HANA, the system returns specific messages. Due to this, an authenticated user with low privileges could guess and enumerate the content shown, beyond their authorized scope. This leads to disclosure of sensitive information causing a high impact on confidentiality, while integrity and availability are unaffected.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-34264"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-204"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-14T01:16:04Z",
    "severity": "MODERATE"
  },
  "details": "During authorization checks in SAP Human Capital Management for SAP S/4HANA, the system returns specific messages. Due to this, an authenticated user with low privileges could guess and enumerate the content shown, beyond their authorized scope. This leads to disclosure of sensitive information causing a high impact on confidentiality, while integrity and availability are unaffected.",
  "id": "GHSA-4c58-m4cg-6h2f",
  "modified": "2026-04-14T03:31:40Z",
  "published": "2026-04-14T03:31:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34264"
    },
    {
      "type": "WEB",
      "url": "https://me.sap.com/notes/3680767"
    },
    {
      "type": "WEB",
      "url": "https://url.sap/sapsecuritypatchday"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-4FQ5-58J6-9QPH

Vulnerability from github – Published: 2023-07-10 18:30 – Updated: 2026-06-01 15:30
VLAI
Details

Observable Response Discrepancy in the SICK ICR890-4 could allow a remote attacker to identify valid usernames for the FTP server from the response given during a failed login attempt.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-35698"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-203",
      "CWE-204"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-07-10T16:15:52Z",
    "severity": "MODERATE"
  },
  "details": "Observable Response Discrepancy in the SICK ICR890-4 could allow a remote attacker to identify valid usernames for the FTP server from the response given during a failed login\nattempt.",
  "id": "GHSA-4fq5-58j6-9qph",
  "modified": "2026-06-01T15:30:31Z",
  "published": "2023-07-10T18:30:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-35698"
    },
    {
      "type": "WEB",
      "url": "https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.json"
    },
    {
      "type": "WEB",
      "url": "https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdf"
    },
    {
      "type": "WEB",
      "url": "https://sick.com/psirt"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-4G8M-5MJ5-C8XG

Vulnerability from github – Published: 2025-05-06 16:38 – Updated: 2025-05-06 19:57
VLAI
Summary
Umbraco Makes User Enumeration Feasible Based on Timing of Login Response
Details

Impact

Based on an analysis of the timing of post login API responses, it's possible to determine whether an account exists.

Patches

Patched in 10.8.10 and 13.8.1.

Workarounds

None available.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Umbraco.Cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-rc1"
            },
            {
              "fixed": "13.8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Umbraco.Cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "10.8.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-46736"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-204"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-05-06T16:38:55Z",
    "nvd_published_at": "2025-05-06T17:16:12Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\nBased on an analysis of the timing of post login API responses, it\u0027s possible to determine whether an account exists.\n\n### Patches\nPatched in 10.8.10 and 13.8.1.\n\n### Workarounds\nNone available.",
  "id": "GHSA-4g8m-5mj5-c8xg",
  "modified": "2025-05-06T19:57:06Z",
  "published": "2025-05-06T16:38:55Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-4g8m-5mj5-c8xg"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46736"
    },
    {
      "type": "WEB",
      "url": "https://github.com/umbraco/Umbraco-CMS/commit/14fbd20665b453cbf094ccf4575b79a9fba07e03"
    },
    {
      "type": "WEB",
      "url": "https://github.com/umbraco/Umbraco-CMS/commit/34709be6cce9752dfa767dffbf551305f48839bc"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/umbraco/Umbraco-CMS"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Umbraco Makes User Enumeration Feasible Based on Timing of Login Response"
}

GHSA-4GRF-X53V-R95X

Vulnerability from github – Published: 2024-05-03 18:30 – Updated: 2024-05-03 18:30
VLAI
Details

IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 could allow a remote user to enumerate usernames due to differentiating error messages on existing usernames. IBM X-Force ID: 199181.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-20556"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-203",
      "CWE-204"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-03T18:15:07Z",
    "severity": "MODERATE"
  },
  "details": "IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 could allow a remote user to enumerate usernames due to differentiating error messages on existing usernames.  IBM X-Force ID:  199181.",
  "id": "GHSA-4grf-x53v-r95x",
  "modified": "2024-05-03T18:30:37Z",
  "published": "2024-05-03T18:30:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20556"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/199181"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7149876"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-4VPG-GWQQ-W44C

Vulnerability from github – Published: 2026-10-02 23:05 – Updated: 2026-10-02 23:05
VLAI
Summary
SiYuan: 17 block metadata/content endpoints in kernel/api/block.go have zero publish-access filtering, reachable by anonymous publish-mode readers
Details

Same CWE-862 family, found via an automated bulk sweep of every /api/block/* handler in kernel/api/block.go for the presence of any access-check reference (IsReadOnlyRoleContext, checkBlockPublishAccess, GetPublishAccess) anywhere in the function body. 17 of 28 candidate endpoints have none. Cross-checked against the file's own sibling functions (getBlockInfo, getBlockDOM, getRefIDs, etc.), which correctly implement the check, confirming this is a real, uneven gap rather than a deliberate design choice for the whole file.

Summary

17 handlers in kernel/api/block.go, all gated only by model.CheckAuth with no admin-role requirement, return block content-derived text, structural metadata, or existence information for any block ID supplied, with no access check anywhere in the handler or, for the ones checked in detail, the model functions they call. This is CWE-862 (Missing Authorization), the same class as the companion advisories from this review round, found in a different file via a systematic bulk check rather than manual inspection of each function individually.

Details

Confirmed via automated extraction of every function body between func NAME(c *gin.Context) { and the next such declaration, then searching each for any of IsReadOnlyRoleContext, checkBlockPublishAccess, GetPublishAccess, or PublishAccess. The following contain none of these, at all:

Endpoint What it discloses
getRefText The block's actual reference-display text, derived from its content, for any ID (kernel/api/block.go:564)
getBlockBreadcrumb The block's breadcrumb/title path (:?)
getBlockDefIDsByRefText Which block IDs a given reference text resolves to
getRefIDsByFileAnnotationID Block IDs referencing a given PDF/file annotation
getBlockIndex / getBlocksIndexes A block's position/index within its document
getTreeStat Structural statistics for a document tree
getBlocksWordCount / getContentWordCount Word/character counts for arbitrary content
checkBlockExist / checkBlocksExist Existence oracle for any block ID
getUnfoldedParentID The nearest unfolded ancestor of a block
checkBlockFold Whether a block is currently folded
getBlockSiblingID A block's sibling in document order
getBlockRelevantIDs IDs of blocks related to a given block
getBlockTreeInfos Block tree metadata for a set of IDs
checkBlockRef Whether a block is referenced elsewhere

The clearest, most severe example, getRefText (POST /api/block/getRefText, kernel/api/router.go:238):

func getRefText(c *gin.Context) {
    ...
    id := arg["id"].(string)
    if util.InvalidIDPattern(id, ret) {
        return
    }
    var refText string
    if notebook, ok := arg["notebook"].(string); ok && notebook != "" && model.IsEncryptedBox(notebook) {
        refText = model.GetBlockRefTextInBox(id, notebook)
    } else {
        refText = model.GetBlockRefText(id)
    }
    ...
    ret.Data = refText
}

model.GetBlockRefText(id) resolves the actual display text used wherever this block is referenced, ordinarily derived from the block's real content, for any id in the workspace, with no scoping.

For contrast, sibling functions in the same file correctly implement the check, e.g. getRefIDs (kernel/api/router.go:235) and getBlockInfo/getBlockDOM/getBlockKramdown all contain if model.IsReadOnlyRoleContext(c) { ... } guards. This confirms the 17 above are an inconsistency within the file, not an intentional decision that the whole file is exempt from this control.

Step-by-step reproduction

# id: a block inside a document that was never published, or is
# Disable=true in publish access
curl -s -X POST http://<target>:6806/api/block/getRefText \
  -H "Content-Type: application/json" -d '{"id":"<private-block-id>"}'
# Returns the block's actual reference text with no session, no
# AccessAuthCode, no publish password.

curl -s -X POST http://<target>:6806/api/block/checkBlockExist \
  -H "Content-Type: application/json" -d '{"id":"<guessed-block-id>"}'
# Confirms or denies existence of any guessed ID workspace-wide.

Repeat against any of the other 15 endpoints in the table above, substituting their expected arguments, each returns data with no access check.

Impact

Any published SiYuan workspace discloses block-level content-derived text, structural metadata, and existence information for the entire workspace, not just published notebooks, to any anonymous internet visitor. getRefText in particular discloses real content text, not just metadata, for any block ID. The existence-oracle endpoints (checkBlockExist/checkBlockRef) combine with the companion advisory's getIDsByHPath title-guessing primitive to let an attacker efficiently probe for and confirm private content without ever needing legitimate access. ```

Affected products

Field Value
Ecosystem Go
Package name github.com/siyuan-note/siyuan/kernel
Affected versions Present at current HEAD (commit eef1056/1673b75, reviewed 2026-08-03)
Patched versions (none yet, leave blank until a fix is released)

Severity

Field Value
Vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Score 7.5 (High). Network vector, low complexity, no privileges or user interaction required, high confidentiality impact via getRefText's real content-text disclosure plus the combined structural/existence oracle from the other 16, no integrity/availability impact since all 17 are read-only.

Weaknesses (CWE)

  • CWE-862: Missing Authorization (primary)
  • CWE-204: Observable Response Discrepancy (contributing, via the existence-oracle endpoints)

Notes for filing

  • Same CWE-862 family as the two companion advisories from this review round (asset/attribute-view listing, and path/title resolution). Recommend the maintainers treat all three as one remediation pass: grep every /api/* handler for the literal presence of IsReadOnlyRoleContext and manually audit every one that lacks it, rather than fixing endpoint-by-endpoint, since the pattern has now recurred across three separate files.
  • Suggested fix: add if model.IsReadOnlyRoleContext(c) { ... } guards matching the pattern already correctly used by this file's own getBlockInfo/getBlockDOM/getRefIDs functions.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/siyuan-note/siyuan/kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20260804015139-bd067a4fe9b2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-74904"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-204",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-02T23:05:33Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "Same CWE-862 family, found via an automated bulk sweep of every\n`/api/block/*` handler in `kernel/api/block.go` for the presence of any\naccess-check reference (`IsReadOnlyRoleContext`, `checkBlockPublishAccess`,\n`GetPublishAccess`) anywhere in the function body. 17 of 28 candidate\nendpoints have none. Cross-checked against the file\u0027s own sibling\nfunctions (`getBlockInfo`, `getBlockDOM`, `getRefIDs`, etc.), which\ncorrectly implement the check, confirming this is a real, uneven gap\nrather than a deliberate design choice for the whole file.\n\n\n### Summary\n17 handlers in `kernel/api/block.go`, all gated only by `model.CheckAuth`\nwith no admin-role requirement, return block content-derived text,\nstructural metadata, or existence information for any block ID supplied,\nwith no access check anywhere in the handler or, for the ones checked in\ndetail, the model functions they call. This is CWE-862 (Missing\nAuthorization), the same class as the companion advisories from this\nreview round, found in a different file via a systematic bulk check\nrather than manual inspection of each function individually.\n\n### Details\nConfirmed via automated extraction of every function body between\n`func NAME(c *gin.Context) {` and the next such declaration, then\nsearching each for any of `IsReadOnlyRoleContext`,\n`checkBlockPublishAccess`, `GetPublishAccess`, or `PublishAccess`. The\nfollowing contain none of these, at all:\n\n| Endpoint | What it discloses |\n|---|---|\n| `getRefText` | The block\u0027s actual reference-display text, derived from its content, for any ID (`kernel/api/block.go:564`) |\n| `getBlockBreadcrumb` | The block\u0027s breadcrumb/title path (`:?`) |\n| `getBlockDefIDsByRefText` | Which block IDs a given reference text resolves to |\n| `getRefIDsByFileAnnotationID` | Block IDs referencing a given PDF/file annotation |\n| `getBlockIndex` / `getBlocksIndexes` | A block\u0027s position/index within its document |\n| `getTreeStat` | Structural statistics for a document tree |\n| `getBlocksWordCount` / `getContentWordCount` | Word/character counts for arbitrary content |\n| `checkBlockExist` / `checkBlocksExist` | Existence oracle for any block ID |\n| `getUnfoldedParentID` | The nearest unfolded ancestor of a block |\n| `checkBlockFold` | Whether a block is currently folded |\n| `getBlockSiblingID` | A block\u0027s sibling in document order |\n| `getBlockRelevantIDs` | IDs of blocks related to a given block |\n| `getBlockTreeInfos` | Block tree metadata for a set of IDs |\n| `checkBlockRef` | Whether a block is referenced elsewhere |\n\nThe clearest, most severe example, `getRefText`\n(`POST /api/block/getRefText`, `kernel/api/router.go:238`):\n```go\nfunc getRefText(c *gin.Context) {\n    ...\n    id := arg[\"id\"].(string)\n    if util.InvalidIDPattern(id, ret) {\n        return\n    }\n    var refText string\n    if notebook, ok := arg[\"notebook\"].(string); ok \u0026\u0026 notebook != \"\" \u0026\u0026 model.IsEncryptedBox(notebook) {\n        refText = model.GetBlockRefTextInBox(id, notebook)\n    } else {\n        refText = model.GetBlockRefText(id)\n    }\n    ...\n    ret.Data = refText\n}\n```\n`model.GetBlockRefText(id)` resolves the actual display text used\nwherever this block is referenced, ordinarily derived from the block\u0027s\nreal content, for any `id` in the workspace, with no scoping.\n\nFor contrast, sibling functions in the same file correctly implement\nthe check, e.g. `getRefIDs` (`kernel/api/router.go:235`) and\n`getBlockInfo`/`getBlockDOM`/`getBlockKramdown` all contain\n`if model.IsReadOnlyRoleContext(c) { ... }` guards. This confirms the\n17 above are an inconsistency within the file, not an intentional\ndecision that the whole file is exempt from this control.\n\n### Step-by-step reproduction\n```bash\n# id: a block inside a document that was never published, or is\n# Disable=true in publish access\ncurl -s -X POST http://\u003ctarget\u003e:6806/api/block/getRefText \\\n  -H \"Content-Type: application/json\" -d \u0027{\"id\":\"\u003cprivate-block-id\u003e\"}\u0027\n# Returns the block\u0027s actual reference text with no session, no\n# AccessAuthCode, no publish password.\n\ncurl -s -X POST http://\u003ctarget\u003e:6806/api/block/checkBlockExist \\\n  -H \"Content-Type: application/json\" -d \u0027{\"id\":\"\u003cguessed-block-id\u003e\"}\u0027\n# Confirms or denies existence of any guessed ID workspace-wide.\n```\nRepeat against any of the other 15 endpoints in the table above,\nsubstituting their expected arguments, each returns data with no\naccess check.\n\n### Impact\nAny published SiYuan workspace discloses block-level content-derived\ntext, structural metadata, and existence information for the *entire*\nworkspace, not just published notebooks, to any anonymous internet\nvisitor. `getRefText` in particular discloses real content text, not\njust metadata, for any block ID. The existence-oracle endpoints\n(`checkBlockExist`/`checkBlockRef`) combine with the companion\nadvisory\u0027s `getIDsByHPath` title-guessing primitive to let an attacker\nefficiently probe for and confirm private content without ever needing\nlegitimate access.\n```\n\n## Affected products\n\n| Field | Value |\n|---|---|\n| Ecosystem | **Go** |\n| Package name | `github.com/siyuan-note/siyuan/kernel` |\n| Affected versions | Present at current HEAD (commit `eef1056`/`1673b75`, reviewed 2026-08-03) |\n| Patched versions | *(none yet, leave blank until a fix is released)* |\n\n## Severity\n\n| Field | Value |\n|---|---|\n| Vector string | `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N` |\n| Score | **7.5 (High)**. Network vector, low complexity, no privileges or user interaction required, high confidentiality impact via `getRefText`\u0027s real content-text disclosure plus the combined structural/existence oracle from the other 16, no integrity/availability impact since all 17 are read-only. |\n\n## Weaknesses (CWE)\n\n- **CWE-862**: Missing Authorization (primary)\n- **CWE-204**: Observable Response Discrepancy (contributing, via the existence-oracle endpoints)\n\n## Notes for filing\n- Same CWE-862 family as the two companion advisories from this review\n  round (asset/attribute-view listing, and path/title resolution).\n  Recommend the maintainers treat all three as one remediation pass:\n  grep every `/api/*` handler for the literal presence of\n  `IsReadOnlyRoleContext` and manually audit every one that lacks it,\n  rather than fixing endpoint-by-endpoint, since the pattern has now\n  recurred across three separate files.\n- Suggested fix: add `if model.IsReadOnlyRoleContext(c) { ... }` guards\n  matching the pattern already correctly used by this file\u0027s own\n  `getBlockInfo`/`getBlockDOM`/`getRefIDs` functions.",
  "id": "GHSA-4vpg-gwqq-w44c",
  "modified": "2026-10-02T23:05:33Z",
  "published": "2026-10-02T23:05:33Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4vpg-gwqq-w44c"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74904"
    },
    {
      "type": "WEB",
      "url": "https://github.com/siyuan-note/siyuan/commit/bd067a4fe9b208c0858d8d9dc6220dc8affc403e"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/siyuan-note/siyuan"
    },
    {
      "type": "WEB",
      "url": "https://github.com/siyuan-note/siyuan/releases/tag/v3.8.0"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/siyuan-before-missing-authorization-via-block-api"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "SiYuan: 17 block metadata/content endpoints in kernel/api/block.go have zero publish-access filtering, reachable by anonymous publish-mode readers"
}

GHSA-552F-97WF-PMPQ

Vulnerability from github – Published: 2024-03-20 17:54 – Updated: 2025-02-12 18:19
VLAI
Summary
Umbraco possible user enumeration
Details

Impact

A user enumeration attack is possible.

Affected versions

Umbraco 10 with access to the native login screen

Patches

This is fixed in 10.8.5

Workarounds

Disabling the native login screen, by exclusively use external logins.

Severity
3.7 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "UmbracoCMS"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.8.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-28868"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-203",
      "CWE-204"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-03-20T17:54:35Z",
    "nvd_published_at": "2024-03-20T20:15:09Z",
    "severity": "LOW"
  },
  "details": "### Impact\nA user enumeration attack is possible.\n\n### Affected versions\nUmbraco 10 with access to the native login screen\n\n### Patches\nThis is fixed in 10.8.5\n\n\n### Workarounds\nDisabling the native login screen, by exclusively use external logins.",
  "id": "GHSA-552f-97wf-pmpq",
  "modified": "2025-02-12T18:19:44Z",
  "published": "2024-03-20T17:54:35Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-552f-97wf-pmpq"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28868"
    },
    {
      "type": "WEB",
      "url": "https://github.com/umbraco/Umbraco-CMS/commit/7e1d1a1968000226cd882fff078b122b8d46c44d"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/umbraco/Umbraco-CMS"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Umbraco possible user enumeration "
}
Mitigation MIT-46
Architecture and Design

Strategy: Separation of Privilege

  • Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
  • Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Mitigation MIT-39
Implementation
  • Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or optimize their original attack, thereby increasing their chances of success.
  • If errors must be captured in some detail, record them in log messages, but consider what could occur if the log messages can be viewed by attackers. Highly sensitive information such as passwords should never be saved to log files.
  • Avoid inconsistent messaging that might accidentally tip off an attacker about internal state, such as whether a user account exists or not.
CAPEC-331: ICMP IP Total Length Field Probe

An adversary sends a UDP packet to a closed port on the target machine to solicit an IP Header's total length field value within the echoed 'Port Unreachable" error message. This type of behavior is useful for building a signature-base of operating system responses, particularly when error messages contain other types of information that is useful identifying specific operating system responses.

CAPEC-332: ICMP IP 'ID' Field Error Message Probe

An adversary sends a UDP datagram having an assigned value to its internet identification field (ID) to a closed port on a target to observe the manner in which this bit is echoed back in the ICMP error message. This allows the attacker to construct a fingerprint of specific OS behaviors.

CAPEC-541: Application Fingerprinting

An adversary engages in fingerprinting activities to determine the type or version of an application installed on a remote target.

CAPEC-580: System Footprinting

An adversary engages in active probing and exploration activities to determine security information about a remote target system. Often times adversaries will rely on remote applications that can be probed for system configurations.

← Back to the CWE list