CVE-2025-46736: Umbraco Makes User Enumeration Feasible Based on Timing of Login Response

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-05-06 · updated 2026-06-17
Weakness: CWE-204

Description

Umbraco is a free and open source .NET content management system. Prior to versions 10.8.10 and 13.8.1, based on an analysis of the timing of post login API responses, it's possible to determine whether an account exists. The issue is patched in versions 10.8.10 and 13.8.1. No known workarounds are available.

Affected products

Umbraco-CMS: before 10.8.10; from 10.9.0 before 13.8.1 — fixed in 10.8.10, 13.8.1

How to fix

Upgrade to a fixed version: Umbraco-CMS 10.8.10, 13.8.1. Check the vendor advisory for mitigations.

References

https://github.com/umbraco/Umbraco-CMS/commit/14fbd20665b453cbf094ccf4575b79a9fba07e03
https://github.com/umbraco/Umbraco-CMS/commit/34709be6cce9752dfa767dffbf551305f48839bc
https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-4g8m-5mj5-c8xg

Get alerted when CVE-2025-46736 or the next vulnerability affects your stack