Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.2

CasaOS login reveals valid usernames

CVE-2024-24766 · published 2 years ago
Summary

In CasaOS versions before 0.4.7, the login screen tells you whether a username exists or not. This lets anyone discover which accounts are registered, which could help further attacks. Upgrade to version 0.4.7 or newer to stop the messages from revealing this information.

What to do
  • Update github.com icewhaletech to version 0.4.7.
Affected software
Ecosystem VendorProductAffected versions
go github.com icewhaletech >= 0.4.4.3, < 0.4.7
Fix: upgrade to 0.4.7
– icewhale casaos-userservice >= 0.4.4-3, <= 0.4.7
cpe:2.3:a:icewhale:casaos-userservice:*:*:*:*:*:*:*:*
Original advisory text
CasaOS Username Enumeration
CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, the Casa OS Login page disclosed the username enumeration vulnerability in the login page. An attacker can enumerate the CasaOS username using the application response. If the username is incorrect application gives the error `**User does not exist**`. If the password is incorrect application gives the error `**Invalid password**`. Version 0.4.7 fixes this issue.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.2 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-204Observable Response Discrepancy
CWE-203Observable Discrepancy
Timeline
Published6 Mar 2024
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-c967-2652-gfjm · GHSA
CVE-2024-24766 · NVD
CVE-2024-24766 · OSV
Track software like this
Free during beta