ApostropheCMS prior to version 4.29.0 contains a timing discrepancy vulnerability (CWE-208) in the /api/v1/@apostrophecms/login/reset-request password reset endpoint. When an invalid user is requested, the system returns after a fixed 2-second delay, but for valid users, it performs a MongoDB update and sends an SMTP email without equivalent delay, resulting in observable timing differences. The endpoint accepts both username and email via an $or query and lacks rate limiting on this endpoint, enabling automated enumeration of valid accounts. This can facilitate credential stuffing or targeted phishing attacks. The vulnerability affects only instances with passwordReset enabled, which defaults to false. The issue is resolved in version 4.29.0.

The vulnerability allows unauthenticated attackers to enumerate valid usernames and emails by measuring response time differences in the password reset endpoint. This information can be leveraged to conduct credential stuffing or targeted phishing attacks. The impact on confidentiality is low, with no direct integrity or availability impact reported. There are no known exploits in the wild.

This vulnerability has been fixed in ApostropheCMS version 4.29.0. Users should upgrade to version 4.29.0 or later to remediate the issue. Instances that do not have the passwordReset option enabled are not affected. There is no indication of official patches outside of upgrading. Patch status is not explicitly stated beyond the fixed version, so users should consult the vendor's release notes for confirmation.