Raytha CMS is vulnerable to user enumeration in the password reset functionality. The system returns different error messages depending on whether the supplied login exists, allowing an attacker to confirm valid usernames. This information disclosure weakness (CWE-204) enables automatic brute‑force attacks against discovered accounts, potentially leading to credential compromise and subsequent unauthorized access.

The vulnerability affects Raytha CMS implementations prior to the release of version 1.5.0. All earlier releases expose the same password reset endpoint behavior, regardless of deployment environment.

The CVSS score of 6.9 indicates a moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. An attacker can exploit the weakness remotely by sending crafted password‑reset requests to the public endpoint; no additional privileges or system access are required beyond internet connectivity.