In Thelia v2.6.0, both the administrative login and forgotten password endpoints return different responses for invalid usernames and incorrect… (CVE-2026-103526)

In Thelia version 2.6.0, the administrative login and forgotten password endpoints respond differently when presented with invalid usernames versus incorrect passwords. This discrepancy allows unauthenticated attackers to enumerate valid administrator accounts. Additionally, the absence of rate limiting or other protections against repeated authentication attempts facilitates efficient username enumeration at scale. The vulnerability is identified as CWE-204 (Information Exposure Through Discrepancy). The CVSS v3.1 base score is 3.7, indicating a low severity vulnerability with network attack vector, high attack complexity, no privileges required, no user interaction, and limited confidentiality impact.

An attacker can enumerate valid administrator usernames by analyzing the differing responses from the login and password reset endpoints. This information disclosure can aid in targeted attacks against administrator accounts. However, the vulnerability does not directly allow unauthorized access or data modification, and the confidentiality impact is limited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing rate limiting or other protections on authentication endpoints to reduce the risk of large-scale username enumeration.