Umbraco possible user enumeration

GHSA-552f-97wf-pmpq · CVE-2024-28868

Published Mar 20, 2024 · Modified Sep 10, 2026

AI SAST

Find this class of vulnerability in your own code

Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.

Explore AI SAST Explore dependency scanning →

Description

Impact

A user enumeration attack is possible.

Affected versions

Umbraco 10 with access to the native login screen

Patches

This is fixed in 10.8.5

Workarounds

Disabling the native login screen, by exclusively use external logins.

References

WEB https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-552f-97wf-pmpq
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2024-28868
WEB https://github.com/umbraco/Umbraco-CMS/commit/7e1d1a1968000226cd882fff078b122b8d46c44d
PACKAGE https://github.com/umbraco/Umbraco-CMS

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes