This vulnerability allows an attacker to enumerate valid usernames on Cacti by exploiting a slightly different error message when an invalid login is attempted. Specifically, the application returns "Access Denied! Login failed." for existing usernames and "Access Denied! Login Failed." for non‑existent usernames, leaking the existence of a user via capitalization. Based on the description, it is inferred that the attacker can send login attempts without prior authentication, and that the difference in capitalization can be used to deduce whether a username is valid, implying a moderate confidentiality risk that could aid in credential guessing or brute‑force attempts.

Cacti, the open source performance and fault management framework, is affected in all releases prior to version 1.2.31. The vulnerability is fixed in 1.2.31 and later.

The CVSS score of 5.3 indicates medium severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting a lower exploitation probability. The likely attack vector is remote, via the login endpoint, and this inference is drawn from the fact that the error messages differ for login attempts. Based on the description, it is inferred that the confidentiality impact is moderate because an attacker can confirm the existence of accounts and potentially proceed to password guessing or credential stuffing.