CVE-2026-25138
Rucio WebUI has Username Enumeration via Login Error Message
- State
- Published
- Severity
- 5.3 Medium
- Published
- Feb 25, 2026
- Updated
- Feb 26, 2026
- Reserved
- Jan 29, 2026
Description
Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Prior to versions 35.8.3, 38.5.4, and 39.3.1, the WebUI login endpoint returns distinct error messages depending on whether a supplied username exists, allowing unauthenticated attackers to enumerate valid usernames. Versions 35.8.3, 38.5.4, and 39.3.1 fix the issue.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | GitHub_M |
Weaknesses
- CWE-204 Observable Response Discrepancy
Affected Products
| Product | Versions |
|---|---|
ruciorucio |
|
References
- https://github.com/rucio/rucio/security/advisories/GHSA-38wq-6q2w-hcf9
- https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html#authentication-and-error-messages
- https://github.com/rucio/rucio/releases/tag/35.8.3
- https://github.com/rucio/rucio/releases/tag/38.5.4
- https://github.com/rucio/rucio/releases/tag/39.3.1
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.