The vulnerability resides in the administrative login and forgotten password endpoints of Thelia v2.6.0, where distinct responses are returned for non‑existent usernames versus incorrect passwords. This difference allows an unauthenticated attacker to discover which administrator accounts exist, providing privileged information without compromising credentials. The flaw constitutes an Authentication Validation Error (CWE‑204) and can lead to credential harvesting or targeted attacks once the attacker knows valid usernames.

The affected product is Thelia, a web‑content management system, specifically versions that include the 2.6.0 release distribution. No other versions are referenced in the advisory.

The CVSS score of 3.7 indicates modest severity; the exploit probability is not quantified in EPSS, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is unauthenticated HTTP requests to the login or password reset endpoints, with no rate limiting or additional safeguards. Without mitigation, an attacker can efficiently enumerate administrator accounts at scale, increasing the risk of subsequent privileged exploits.