CWE-204: Observable Response Discrepancy
The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.
A kind of CWE-203 Observable Discrepancy.
From the CWE List. © The MITRE Corporation.
Newest
- go-vikunja vikunja Vikunja before 2.7.1 Information Disclosure via Team Self-Removal Endpoint 7.1 High
- ibm api connect Multiple Vulnerabilities in IBM API Connect 5.3 Medium
- suitecrm SuiteCRM: V8 OAuth2 Username Enumeration 6.9 Medium
- sysadminsmedia homebox HomeBox: Timing Side-Channel in Login Endpoint Allows User Enumeration via Bcrypt Hashing Delay 3.7 Low
- openedx openedx-platform Open edX: Support "manage_course_team" REST API omits the `require_support_permission` gate its sibling support views enforce 5.3 Medium
- blueprintue blueprintue-self-hosted-edition blueprintUE Self-Hosted Edition before 4.3.3 Account Enumeration via Password Reset 6.9 Medium
- wpgraphql WPGraphQL before 2.24.2 Object Existence Disclosure via Media and Comment Mutations 6.9 Medium
- rolantis information technologies agentis User Enumeration in Rolantis Information Technologies' Agentis 7.5 High
- cacti Cacti: User Enumeration via Error Messages 5.3 Medium
- wso2 api manager, carborn identity handler, identity server +3 more +5 more Username Enumeration via External User Stores in Multiple WSO2 Products Allows User Account Discovery 5.8 Medium
- fossbilling FOSSBilling: Unauthenticated client account enumeration via guest signup endpoint 6.9 Medium
- thorsten phpmyfaq phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Account Enumeration via Guest Comment Endpoint 6.9 Medium
- guangzhou juan iot technology co., ltd. eseecloud app, eseecloud firmware +1 more Guangzhou Juan IoT Technology EseeCloud Observable Response Discrepancy 6.9 Medium
- ikas technology inc. e-commerce infrastructure User Enumeration via Password Reset in IKAS Technology Inc.'s ikas E-Commerce Infrastructure 7.5 High
- nezhahq nezha Nezha 1.7.0 before 2.3.15 Cross-Tenant Server-ID Enumeration via getServerConfig 5.3 Medium
- openstack horizon, the opennms group meridian +1 more OpenNMS REST authorization bypass via non-canonical HTTP method 9.1 Critical
- amazon amazon.extensions.s3.encryption RSA PKCS#1 v1.5 padding oracle via legacy envelope key format downgrade in Amazon S3 Encryption Client for .NET 6.0 Medium
- thelia CVE-2026-103526 3.7 Low
- logicaldoc community edition LogicalDOC Community Edition through 9.3 Username Enumeration via AvatarServlet 6.9 Medium
- contao Contao: The registration module re-sends activation mails on any unauthenticated POST, with no throttle and no captcha check 5.3 Medium
- zabbix Hidden host credentials inferable via multiselect.get filtering 5.1 Medium
- utmstack UTMStack < 11.2.16 Account Enumeration via Password Reset Endpoint 6.9 Medium
- yeswiki YesWiki before 4.6.7 User Enumeration via Lost-Password Flow 7.1 High
- maksisoft technology, it, and software industry and trade inc. gym Username Enumeration in Maksisoft Technology's Maksisoft Gym 5.3 Medium
- moodle Moodle: user list filters bypass profile field visibility 2.7 Low
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 more Automation-controller: automation-controller: unauthenticated 200-vs-403 oracle in bitbucket data center webhook receiver enumerates webhook-enabled job templates 5.3 Medium
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 more Automation-controller: automation-controller-container: automation-controller: custom_venv_path setting provides filesystem path-existence oracle on control pod 4.1 Medium
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 more Automation-controller: automation-controller-container: automation-controller: named-url 404 body oracle enables cross-tenant resource name enumeration 5.0 Medium
- kingdom communication associated eh1000b, eh2070, eh3040 +1 more +3 more Kingdom Communication Associated｜Smart Video Intercom System - Sensitive Data Exposure 6.9 Medium
- dernekplus website template User Enumeration in DernekPlus' Website Template 5.3 Medium
- grokability snipe-it Snipe-IT before 8.7.0 License Key Exposure via CSV Export 7.1 High
- gastromenum web panel User Enumeration in GastroMenum's GastroMenum Web Panel 7.5 High
- menulux software inc. portal Username Enumeration in Menulux Software's Menulux Portal 7.5 High
- elastic kibana Observable Response Discrepancy in Kibana Leading to Cross-Space Information Disclosure 4.3 Medium
- filamentphp filament Filament: Password validity disclosure for accounts denied panel access on login page 3.7 Low
- automatisch Automatisch through 0.15.0 User Enumeration via Forgot-Password Response Discrepancy 6.9 Medium
- rocket.chat Rocket.Chat Missing DDP Rate Limit on the sendForgotPasswordEmail Meteor Method 6.9 Medium
- combodo itop Combodo iTop: User enumeration via password reset 7.5 High
- microsoft azure stack hci Azure Stack HCI Information Disclosure Vulnerability 8.6 High
- coder Coder before 2.34.2 User Enumeration via Login Placeholder Hash 6.3 Medium
- elated-themes frappe Frappe: User Enumeration via PDDR 6.9 Medium
- lemmynet lemmy Lemmy: Login Endpoint User Enumeration via HTTP Response Code Differential 6.9 Medium
- siyuan-note siyuan SiYuan before v3.7.4 Missing Authorization via block API 8.7 High
- unspecified automad automad Password Reset Endpoint UserController.php requestPasswordResetToken response discrepancy 6.3 Medium
- postgresql PostgreSQL observable response discrepancy with non-default scram_iterations provides user existence oracle 5.3 Medium
- bluewave-labs checkmate bluewave-labs Checkmate - User Enumeration via Differential HTTP Response in Password Recovery 5.3 Medium
- suse rancher Cluster Existence Oracle via Unauthenticated Import Endpoint 5.3 Medium
- eclipse milo In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable... 9.1 Critical
- bilin software and informatics consultancy inc. humanist digital human resources Username Enumeration via Differential Login Responses in Bilin Software's HUMANIST Digital Human Resources 5.3 Medium
- wp-graphql WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design) 6.9 Medium
- Show olderLoading…