UpHeron
All vulnerabilities

Servers and applications

CVE-2025-46736

User Enumeration Feasible Based on Timing of Login Response

Severity
Medium 5.3
Published
6 May 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
10.8.10, 13.8.1
Also known as
GHSA-4g8m-5mj5-c8xg
Sources
NVD, Project advisories (GitHub)

Description

Umbraco is a free and open source .NET content management system. Prior to versions 10.8.10 and 13.8.1, based on an analysis of the timing of post login API responses, it's possible to determine whether an account exists. The issue is patched in versions 10.8.10 and 13.8.1. No known workarounds are available.

Affected software

SoftwareAffected versions
Umbraco CMSServers and applications · cpe:a:umbraco:umbraco_cms
  • Every version before 10.8.10
  • From 10.9.0 before 13.8.1
Umbraco CMSServers and applications · github:umbraco/umbraco-cms
  • Every version before 10.8.10

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-46736
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-46736
  • GitHub Advisory Database https://github.com/advisories/GHSA-4g8m-5mj5-c8xg
  • github.com https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-4g8m-5mj5-c8xg