Skip to main content

Observable Response Discrepancy

CVE-2025-46736

Medium
5.3/10

Summary

Umbraco is a free and open source .NET content management system. In versions through 10.8.9 and 11.0.0-rc1 through 13.8.0, based on an analysis of the timing of post login API responses, it's possible to determine whether an account exists.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • LOW
  • NONE

CWE-204 - Observable Response Discrepancy

The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.

References

Advisory Timeline

  • Published