CVE-2025-58579
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
Due to a lack of authentication, an unauthenticated user can request data from this endpoint, making the application vulnerable to user enumeration.
Risk Assessment
An attacker can gather information about existing user accounts, potentially facilitating targeted attacks such as brute force or phishing. This is a confidentiality breach and may lead to further compromises.
Recommendation
Implement authentication for this endpoint or limit the information disclosed. Also monitor for unusual requests and implement rate limiting.
Other vulnerabilities in Unknown application
See all- CVE-2026-50208Critical
High-risk TrustAllCerts routines disable standard TLS certificate validation. Combined with hard-coded DES encryption keys, a Man-in-the-Middle attacker can decrypt network traffic.
- CVE-2026-14953Medium
A low-privileged remote attacker can enumerate all configured users and identify accounts with elevated privileges using the endpoint /api/user/fetch-all.php.
- CVE-2026-14949Medium
A low-privileged remote attacker with a valid session can create new user accounts with arbitrary role values, including the highest privilege level, using the /api/user/add.php endpoint.
- CVE-2025-58581Medium
When an error occurs in the application a full stacktrace is provided to the user. The stacktrace lists class and method names as well as other internal information. An attacker can thus obtain information about the technology used and the structure of the application.
Original NVD description (English source)
Due to a lack of authentication, it is possible for an unauthenticated user to request data from this endpoint, making the application vulnerable for user enumeration.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS