What’s Vulnerable › Vulnerabilities

CVE-2024-24766: CasaOS Username Enumeration

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-03-06 · updated 2026-06-17
• Weakness: CWE-204

Description

CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, the Casa OS Login page disclosed the username enumeration vulnerability in the login page. An attacker can enumerate the CasaOS username using the application response. If the username is incorrect application gives the error `**User does not exist**`. If the password is incorrect application gives the error `**Invalid password**`. Version 0.4.7 fixes this issue.

Affected products

• Icewhale Casaos-Userservice: from 0.4.4-3 through 0.4.7

References

• https://github.com/IceWhaleTech/CasaOS-UserService/commit/c75063d7ca5800948e9c09c0a6efe9809b5d39f7
• https://github.com/IceWhaleTech/CasaOS-UserService/releases/tag/v0.4.7
• https://github.com/IceWhaleTech/CasaOS-UserService/security/advisories/GHSA-c967-2652-gfjm
• https://github.com/IceWhaleTech/CasaOS-UserService/commit/c75063d7ca5800948e9c09c0a6efe9809b5d39f7
• https://github.com/IceWhaleTech/CasaOS-UserService/releases/tag/v0.4.7
• https://github.com/IceWhaleTech/CasaOS-UserService/security/advisories/GHSA-c967-2652-gfjm
• https://github.com/IceWhaleTech/CasaOS-UserService/security/advisories/GHSA-hcw2-2r9c-gc6p

Get alerted when CVE-2024-24766 or the next vulnerability affects your stack