The vulnerability arises when the login interface returns distinct messages for valid versus invalid usernames, permitting an attacker to confirm the existence of accounts. This information disclosure allows adversaries to build a list of legitimate usernames, which can be leveraged for targeted credential guessing or phishing attacks. The weakness aligns with Information Exposure weaknesses, specifically CWE-200. The flood of valid usernames can facilitate further attacks that rely on knowing user identities, compromising overall security.

Sage DPW 2021_06_004 and earlier releases prior to 2021_06_000 are affected. On-premise administrators can enable or disable this enumeration behavior in newer releases; however, older versions lack this configurable option and therefore remain vulnerable.

The CVSS score of 3.7 indicates a moderate risk level; the exploitation does not require advanced privileges and can be performed remotely by attempting logins against the application. No EPSS data is available, so the likelihood cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, through the publicly exposed login endpoint, and requires only publicly known usernames or guessable strings.