Servers and applications
CVE-2019-3990
User Enumeration Vulnerability (CVE-2019-3990)
- Severity
- Medium 4.3
- Published
- 3 Dec 2019
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Exploit chance
- 1% in the next 30 daysHigher than 64% of CVEs. EPSS by FIRST, 10 Nov 2026
- Attack
- Over the network · Needs a user account · No user action needed
- Attacker can
- Read some data
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N- Also known as
- GHSA-6qj9-33j4-rvhg
- Sources
- NVD, Project advisories (GitHub)
Description
Nick Manfredi of Tenable Research has discovered a User Enumeration flaw in Harbor. The issue is present in the "/users" api endpoint. This endpoint is supposed to be restricted to administrators. This restriction is able to be bypassed and information can be obtained via the "search" functionality.
Non-administrator users (such as those created via self-registration) can list all usernames and user IDs by sending a GET request to /api/users/search with no parameters, as follows:
curl -X GET "http:///api/users/search" -H "accept: application/json" --user :
Using the email filter allows a non-administrator user to confirm the email address associated with a username, as follows:
curl -X GET "http:///api/users/[email protected]" -H "accept: application/json" --user :
This filter may also be used to determine information about a user's email, as all users matching any part of the email parameter will be returned:
Workarounds
There is no workaround for this issue
Affected software
| Software | Affected versions |
|---|---|
HarborServers and applications · cpe:a:linuxfoundation:harbor |
All 7 release lines
|
HarborServers and applications · github:goharbor/harbor |
|
References
- NVD https://nvd.nist.gov/vuln/detail/CVE-2019-3990
- CVE.org https://www.cve.org/CVERecord?id=CVE-2019-3990
- GitHub Advisory Database https://github.com/advisories/GHSA-6qj9-33j4-rvhg
- github.com https://github.com/goharbor/harbor/security/advisories/GHSA-6qj9-33j4-rvhg