CWE-204 vulnerabilities

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows remote attackers to enumerate usernames by observing differences in response behavior. This issue is classified as CWE-204, Observable Response Discrepancy. The vulnerability has a medium severity with a CVSS score of 5.3.

SuiteCRM versions prior to 7.15.2 and 8.10.2 have a vulnerability in the /legacy/Api/V8/OAuth2 password-grant endpoint where distinct error messages are returned for invalid usernames versus invalid passwords. This allows unauthenticated attackers to enumerate valid usernames, facilitating targeted attacks such as password spraying and credential stuffing. The issue is fixed in versions 7.15.2 and 8.10.2.

HomeBox versions prior to 0.27.0 have a timing side-channel vulnerability in the login endpoint. The POST /api/v1/users/login endpoint verifies password hashes only for existing usernames, while unknown usernames return immediately. Although both cases respond with a 401 unauthorized status, the difference in processing time allows remote attackers to distinguish valid registered email addresses. This information disclosure vulnerability is fixed in version 0.27.0.

A vulnerability in Open edX Platform's CourseTeamManageAPIView endpoint allows any authenticated user to distinguish active user accounts from inactive or absent ones by observing different HTTP responses. This affects versions from the Ulmo release until release/ulmo.4 and release/verawood.1. The issue is fixed in release/ulmo.4 and release/verawood.1. Anonymous users are not affected, and the PUT method is separately authorized and not vulnerable.

Observable response discrepancy vulnerability in Rolantis Information Technologies Tourism Industry and Trade Co. Ltd. Agentis allows Account Footprinting. This issue affects Agentis: before 4.8.

Cacti versions prior to 1.2.31 contain a User Enumeration vulnerability where login error messages differ subtly based on username validity, allowing attackers to identify valid usernames. This issue has been fixed in version 1.2.31.

CVE-2024-7478 is a vulnerability in WSO2 API Manager that allows username enumeration when the product is configured to use an external user store. The system does not sufficiently obscure whether a username exists during authentication attempts, enabling attackers to identify valid usernames by repeated queries. This can facilitate targeted brute-force attacks and social engineering. The vulnerability affects multiple versions of WSO2 API Manager prior to specific fixed releases.

CVE-2026-111056 is an information exposure vulnerability in FOSSBilling versions from 0.1.0 up to but not including 0.8.7. The unauthenticated POST /api/guest/client/create endpoint reveals whether a submitted email address belongs to an existing registered client by returning a distinct unredacted error message. This allows an attacker to enumerate registered client emails. The issue is fixed in version 0.8.7.

CVE-2026-105664 is a medium severity vulnerability in the EseeCloud App by Guangzhou Juan IoT Technology Co., Ltd. The app's endpoint reveals different error responses when queried with valid versus nonexistent 10-digit ID values. This behavior allows an attacker with a valid access token but no further authentication to enumerate registered device IDs at scale due to the lack of effective rate limiting.

Observable response discrepancy vulnerability in IKAS Technology Inc. Ikas E-Commerce Infrastructure allows Account Footprinting. This issue affects ikas E-Commerce Infrastructure: through 2026-07-13.

CVE-2026-111235 is a critical authorization bypass vulnerability in the REST API of multiple versions of OpenNMS Meridian and Horizon. The issue arises from case-sensitive HTTP method checks in Spring Security filter chains, allowing requests with non-canonical (e.g., lowercase) HTTP methods to bypass authentication. This enables remote unauthenticated attackers to read monitored inventory and create, modify, or delete resources, including injecting events to manipulate alarms. The vulnerability is fixed by adding terminal deny rules to REST filter chains. Upgrading to Meridian 2024.3.14, 2025.0.11, 2026.0.1 or Horizon 36.0.5 or newer resolves the issue. These products are intended for private network use and should not be exposed directly to the Internet.

A remote user who can read encrypted objects in the S3 bucket can force a padding downgrade by altering the padding scheme recorded in an object's metadata to legacy PKCS#1 v1.5. Since this padding scheme is susceptible to the well-known Bleichenbacher attack, the user can use a PKCS#1 v1.5 padding oracle to recover the RSA-wrapped envelope key and decrypt the object. To remediate this issue, we recommend that users upgrade to version 3.2.2 or 4.0.3. The 1.x and 2.x lines will not be patched, users of those lines need to migrate to 3.2.2 or 4.0.3.

Observable response discrepancy vulnerability in Maksisoft Technology, IT, and Software Industry and Trade Inc. Maksisoft Gym allows Account Footprinting. This issue affects Maksisoft Gym: from 0.5.10 before 0.5.11.

CVE-2026-84717 is an information disclosure vulnerability in Red Hat Ansible Automation Platform 2.5 for RHEL 8. The flaw exists in the automation-controller's Bitbucket Data Center webhook receiver, where unauthenticated diagnostics:ping events skip HMAC signature verification after template lookup. This causes the endpoint to respond with HTTP 200 if a Bitbucket DC webhook is configured on a template and HTTP 403 otherwise. An unauthenticated attacker can use this response difference to enumerate which Job Template and Workflow Job Template IDs have Bitbucket DC webhooks configured without knowing the secret webhook key.

CVE-2026-71462 is a moderate severity information disclosure vulnerability in Red Hat Ansible Automation Platform 2.5 for RHEL 8. It arises from the automation-controller component's validation function calling os.path.exists() on user-supplied absolute paths without bounds. An authenticated tenant superuser can distinguish HTTP 200 versus 400 responses to confirm the existence of arbitrary files on the controller-web pod, including sensitive files like the controller secret key and Kubernetes service-account tokens. This flaw mainly impacts managed Ansible Automation Platform deployments where tenant superusers lack host-level control. Only file existence is revealed, not contents. No effective mitigation is currently available, and a fix is being pursued for versions 2.5, 2.6, and 2.7, but not for 2.4.

URLModificationMiddleware resolves named-URL lookups against unfiltered Model.objects before RBAC. The 403→404 shim only rewrites 403 responses, leaving the pk=0 miss path with a different 404 detail string. Differential "Not found." vs "No <Model> matches..." reveals whether a named resource (org, credential, inventory, host) exists anywhere on the platform. Enables cross-tenant internal hostname enumeration.

Smart Video Intercom System developed by Kingdom Communication Associated has a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can enumerate valid user accounts by exploiting differences in system responses.

Observable response discrepancy vulnerability in DernekPlus Website Template allows Account Footprinting. This issue affects Website Template: through 10092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Observable response discrepancy vulnerability in GastroMenum GastroMenum Web Panel allows Account Footprinting. This issue affects GastroMenum Web Panel: before 31.08.2026.

Observable response discrepancy vulnerability in Menulux Software Inc. Menulux Portal allows Account Footprinting. This issue affects Menulux Portal: before 20260903211448.