By weakness (CWE)

CWE-203: related vulnerabilities

CVEs classified under CWE-203. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

12 published vulnerabilities

• CVE-2023-54357HIGH 7.5

  The Joomla com_booking component version 2.4.9 has a flaw that lets anyone on the internet harvest user account information without logging in. By making simple web requests with different user ID numbers, an attacker can discover usernames, display names, and email addresses stored in the system. This is a classic enumeration attack—attackers don't need valid credentials or special access, just the ability to send HTTP requests and patience to try many ID values.

• CVE-2026-51926HIGH 7.5

  A vulnerability in docuForm GmbH FSM Client version 11.11c allows attackers to identify valid user accounts without authentication. By submitting login attempts, an attacker can observe differences in how the system responds to existing versus non-existing usernames. This user enumeration flaw doesn't directly compromise accounts, but it significantly reduces the difficulty of subsequent attacks like password guessing or credential stuffing, making it a stepping stone to account compromise.

• CVE-2026-11284MEDIUM 6.5

  Google Chrome versions prior to 149.0.7827.53 contain a side-channel vulnerability in the Performance APIs that allows an attacker to extract sensitive data across website boundaries. An attacker can craft a malicious webpage that, when visited by a user, leaks information from other websites the user is viewing or has visited. This works because certain performance measurement features can infer timing details that reveal cross-origin data, even though browsers are designed to isolate websites from each other.

• CVE-2026-11289MEDIUM 6.5

  A side-channel vulnerability in Google Chrome's Paint component allows attackers to leak sensitive cross-origin data through a specially crafted web page. An attacker would need to trick a user into visiting a malicious website, but once there, the vulnerability could expose information from other websites the user has open—a serious privacy breach. The issue affects Chrome versions before 149.0.7827.53 across Windows, macOS, and Linux.

• CVE-2026-14071MEDIUM 6.5

  Google Chrome versions before 150.0.7871.47 contain a side-channel vulnerability in the WebAudio component that allows attackers to extract sensitive cross-origin data through a specially crafted webpage. An attacker would need to trick a user into visiting a malicious site, but once there, they could potentially read data from other websites the user has open—a serious breach of browser security boundaries. The vulnerability is rated MEDIUM severity due to its reliance on user interaction and limited scope of impact.

• CVE-2026-14112MEDIUM 5.3

  Google Chrome versions before 150.0.7871.47 contain a flaw in how the browser handles certain user interactions on web pages. An attacker who tricks a user into performing specific gestures (like clicking or dragging) on a malicious webpage can potentially read sensitive data from Chrome's memory. While the Chromium team rates this as low severity, the ability to extract process memory elevates the practical risk. The vulnerability requires active user participation—it cannot be exploited passively.

• CVE-2026-44332MEDIUM 5.3

  Fiber, a popular Go web framework modeled after Express.js, contains a timing-based username enumeration vulnerability in its BasicAuth middleware. When authentication is attempted, the framework's default authorizer function checks whether a username exists before validating the password. An attacker can exploit this by observing subtle differences in response times—valid usernames return faster than invalid ones because the password comparison step is skipped entirely for non-existent users. This allows an attacker to reliably discover which usernames are active on a system without needing valid credentials. The flaw affects all versions prior to 3.3.0.

• CVE-2026-45294MEDIUM 5.3

  FreeScout, a Laravel-based open-source help desk platform, leaks information about whether an email address is registered as a helpdesk agent account. An attacker can repeatedly submit email addresses to the password reset feature and observe different visual responses that reveal which accounts exist—a technique called user enumeration. This flaw affects all versions before 1.8.219 and requires no authentication or user interaction to exploit.

• CVE-2026-45410MEDIUM 5.3

  TREK, a collaborative travel planning application, contains a user enumeration vulnerability in its login process that allows attackers to determine whether specific email addresses have accounts in the system. The flaw stems from a timing discrepancy: when a user submits a login attempt with a valid email address, the backend takes approximately 370 milliseconds to complete its password check before denying access. For non-existent accounts, the system responds in roughly 10 milliseconds. This 14-fold difference in response time leaks account existence information without any change in HTTP status codes or error messages, making it detectable through simple response timing analysis. The issue has been resolved in version 3.0.18.

• CVE-2026-56316MEDIUM 5.3

  Cap-go versions before 12.128.2 expose a weakness in how the build upload endpoint responds to requests. An attacker doesn't need credentials to send specially crafted requests and figure out which job IDs are real ones based on how the server responds. This allows them to probe the system repeatedly, potentially causing performance issues through sustained unauthenticated traffic.

• CVE-2026-56327MEDIUM 5.3

  Capgo versions before 12.128.2 contain a flaw that lets unauthenticated attackers figure out which organizations exist in the system. An attacker can use a publicly available API key to call a specific function and observe whether the system responds with 'organization doesn't exist' versus 'you don't have permission.' By comparing these two different error messages, an attacker can methodically discover which organization IDs are valid, essentially mapping out the tenant structure without needing legitimate credentials.

• CVE-2026-56319MEDIUM 4.3

  Capgo versions before 12.128.2 leak information that allows authenticated users with limited API access to discover app IDs they shouldn't know about. By observing how the server responds to requests, an attacker can figure out which other apps exist in the system—even apps they have no permission to access. This breaks the isolation between different customer accounts and their data.