CVE-2026-103526
3.7LowPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-204
Impact
Unauthenticated remote attackers can reliably enumerate valid administrator usernames at scale over the network. This exposes admin account names for subsequent credential brute-forcing attacks.
Root cause
Administrative authentication and password recovery endpoints return observable differential responses between nonexistent usernames and incorrect passwords while lacking rate limiting.
Affected systems
Thelia v2.6.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Fix & remediation
Upgrade to a fixed version once released by the vendor; as an immediate interim mitigation, restrict access to administrative login endpoints via web server access controls or apply rate limiting at your reverse proxy.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
In Thelia v2.6.0, both the administrative login and forgotten password endpoints return different responses for invalid usernames and incorrect passwords, allowing unauthenticated attackers to enumerate valid administrator accounts. Because the endpoint also lacks rate limiting or other protections against repeated authentication attempts, username enumeration can be performed efficiently at scale.