Account Enumeration Vulnerability in Umbraco by Umbraco

CVE-2025-46736

What is CVE-2025-46736?

Umbraco CMS, a free and open-source .NET content management system, is susceptible to an account enumeration vulnerability. Prior to the updates in versions 10.8.10 and 13.8.1, an attacker could leverage the timing of API responses following user login attempts to ascertain the existence of specific accounts. This loophole poses a significant security risk, as it can be exploited to gather information about valid usernames. Users are strongly urged to update to the latest versions to mitigate this vulnerability, as there are no effective workarounds currently available.

References