ownCloud Guests versions before 0.12.5 contain a vulnerability that allows unauthenticated attackers to enumerate valid guest users by exploiting differences in server responses at the /apps/guests/register/{email}/{token} endpoint. This occurs due to insufficient validation of the token parameter in the showPasswordForm function.