CVE-2026-103526 Details
Description
In Thelia v2.6.0, both the administrative login and forgotten password endpoints return different responses for invalid usernames and incorrect passwords, allowing unauthenticated attackers to enumerate valid administrator accounts. Because the endpoint also lacks rate limiting or other protections against repeated authentication attempts, username enumeration can be performed efficiently at scale.
A vulnerability in Thelia version 2.6.0 allows unauthenticated attackers to enumerate valid administrator usernames through the administrative login and forgotten password endpoints. These endpoints respond differently to invalid usernames and incorrect passwords, creating an opportunity for username enumeration. Additionally, the lack of rate limiting or protections against repeated authentication attempts enables efficient, large-scale exploitation of this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 12, 2026CISA-ADP
Assessed Oct 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://kb.cert.org/vuls/id/162329 | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-204 | Observable Response Discrepancy | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Thelia | 2.6.0 (semver) 2.6.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 12, 2026 | New CVE Received | [email protected] |
| Oct 12, 2026 | CVE Modified | CISA-ADP |