What is GHSA-4g8m-5mj5-c8xg?

GHSA-4g8m-5mj5-c8xg is a security advisory published by GitHub Security Advisories with Medium severity. Umbraco Makes User Enumeration Feasible Based on Timing of Login Response

Which CVE IDs does GHSA-4g8m-5mj5-c8xg cover?

GHSA-4g8m-5mj5-c8xg covers the following CVE IDs: CVE-2025-46736. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-4g8m-5mj5-c8xg?

GHSA-4g8m-5mj5-c8xg has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

Which products are affected by GHSA-4g8m-5mj5-c8xg?

GHSA-4g8m-5mj5-c8xg affects 2 products, including: nuget/Umbraco.Cms:\u003e= 11.0.0-rc1, \u003c 13.8.1; nuget/Umbraco.Cms:\u003c 10.8.10.

GHSA-4g8m-5mj5-c8xgMediumCVSS 5.3

Umbraco Makes User Enumeration Feasible Based on Timing of Login Response

Vendor

GitHub Security Advisories

Published

May 6, 2025

Last Modified

May 6, 2025

🔗 CVE IDs covered (1)

CVE-2025-46736 →

📋 Description

Impact

Based on an analysis of the timing of post login API responses, it's possible to determine whether an account exists.

Patches

Patched in 10.8.10 and 13.8.1.

Workarounds

None available.

🎯 Affected products2

nuget/Umbraco.Cms:>= 11.0.0-rc1, < 13.8.1
nuget/Umbraco.Cms:< 10.8.10

🔗 References (5)

https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-4g8m-5mj5-c8xg
https://github.com/umbraco/Umbraco-CMS/commit/14fbd20665b453cbf094ccf4575b79a9fba07e03
https://github.com/umbraco/Umbraco-CMS/commit/34709be6cce9752dfa767dffbf551305f48839bc
https://nvd.nist.gov/vuln/detail/CVE-2025-46736
https://github.com/advisories/GHSA-4g8m-5mj5-c8xg