The vulnerability in UserSpice 4.3.24 permits an unauthenticated attacker to discover which usernames exist in the system. By sending a POST request to existingUsernameCheck.php and examining the response for the string taken, an attacker can enumerate all valid accounts. This information can be used to launch credential‑guessing, phishing, or other targeted attacks. The flaw is a classic username‑enumeration weakness identified as CWE‑204.

Affected systems are installations built with UserSpice version 4.3.24. The CNA data does not list other affected versions. Administrators should confirm whether the system runs this release and assess whether a patch or upgrade is required.

The CVSS score of 9.3 indicates a severe flaw, while no EPSS score is available and the vulnerability is not catalogued in CISA KEV. The likely attack vector is over the network via HTTP; the attacker requires no authentication, and enumeration can be automated by sending multiple POST requests to the endpoint. Because the response reveals whether a username is taken, the risk of subsequent attacks is high.