This vulnerability enables an attacker to determine whether a username exists in the system by analyzing the difference in responses returned by the login mechanism. The distinct responses for valid versus invalid usernames expose a privacy compromise and can be leveraged to gather a list of valid accounts. The weakness is categorized under CWE-204: Information Exposure Through Unintended Data Disclosure.

Sage DPW versions prior to 2021_06_000 are affected, including the 2025_06_004 release used by on‑premise environments. On‑premise administrators have the ability to toggle this behavior in newer releases, thus mitigating the issue for current deployments.

The CVSS score of 4.7 indicates moderate severity, with an EPSS scoring below 1 % and no listing in the CISA KEV catalog. The likely attack vector is a network‑based login attempt to the Sage DPW authentication endpoint. While successful enumeration does not directly grant credential compromise, it facilitates targeted credential stuffing or phishing attacks, thereby increasing the overall threat to confidentiality and potentially enabling further exploitation once credentials are obtained.