CVE-2026-49442
MEDIUM
5,3
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: low
Integrity: none
Availability: none
Description
Cacti is an open source performance and fault management framework. Prior to version 1.2.31, a User Enumeration vulnerability allows an attacker to identify valid usernames on the Cacti service. When a user attempts to log in, the application returns slightly different error messages depending on whether the provided username exists in the system. When username exists on Cacti, in the response, they see Access Denied! Login failed. When it does not exist on Cacti, they see Access Denied! Login Failed. The only difference between the responses is the capitalization of the letter 'f' in the word failed. This issue has been patched in version 1.2.31.
204
Observable Response Discrepancy
IncompleteCommon Consequences
Security Scopes Affected:
Confidentiality
Access Control
Potential Impacts:
Read Application Data
Bypass Protection Mechanism
Applicable Platforms
All platforms may be affected
https://github.com/Cacti/cacti/commit/ab4baf338d65dcaafe1bd97d1e2a310fe0af0e3e
https://github.com/Cacti/cacti/pull/7166
https://github.com/Cacti/cacti/security/advisories/GHSA-m7v2-f3xw-3qh7