Account Enumeration Vulnerability in Thelia by Thelia Team

CVE-2026-103526

What is CVE-2026-103526?

In Thelia version 2.6.0, vulnerabilities exist within the administrative login and password recovery functionalities. These endpoints respond differently to invalid usernames and incorrect passwords, thereby allowing attackers to successfully enumerate valid administrator accounts. Furthermore, the absence of rate limiting or other forms of protection against repeated authentication attempts means that this enumeration can be conducted efficiently and at scale, posing a significant security risk to the affected system.

References