Description
In Thelia v2.6.0, both the administrative login and forgotten password endpoints return different responses for invalid usernames and incorrect passwords, allowing unauthenticated attackers to enumerate valid administrator accounts. Because the endpoint also lacks rate limiting or other protections against repeated authentication attempts, username enumeration can be performed efficiently at scale.
Published: 2026-10-12
Score: 3.7 Low
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://kb.cert.org/vuls/id/162329 cve-icon cve-icon
History

Mon, 12 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-204
Metrics cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 12 Oct 2026 15:00:00 +0000

Type Values Removed Values Added
Description In Thelia v2.6.0, both the administrative login and forgotten password endpoints return different responses for invalid usernames and incorrect passwords, allowing unauthenticated attackers to enumerate valid administrator accounts. Because the endpoint also lacks rate limiting or other protections against repeated authentication attempts, username enumeration can be performed efficiently at scale.
Title CVE-2026-103526
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: certcc

Published:

Updated: 2026-10-12T14:58:40.777Z

Reserved: 2026-09-30T19:06:30.711Z

Link: CVE-2026-103526

cve-icon Vulnrichment

Updated: 2026-10-12T14:58:34.939Z

cve-icon NVD

Status : Received

Published: 2026-10-12T15:17:06.073

Modified: 2026-10-12T15:17:06.073

Link: CVE-2026-103526

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-204

    Observable Response Discrepancy