CVE-2026-25138

· MEDIUMAnalyzed

← All CVEs

CVSS v3.1

5.3

EPSS

0.33%

Published

Feb 25, 2026

Modified

Feb 27, 2026

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Prior to versions 35.8.3, 38.5.4, and 39.3.1, the WebUI login endpoint returns distinct error messages depending on whether a supplied username exists, allowing unauthenticated attackers to enumerate valid usernames. Versions 35.8.3, 38.5.4, and 39.3.1 fix the issue.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-204

Affected Products (3)

cern · rucio (up to 35.8.3)vulnerable

cern · rucio (up to 38.5.4)vulnerable

cern · rucio (up to 39.3.1)vulnerable

References (6)

https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html#authentication-and-error-messages

Not Applicable

https://github.com/rucio/rucio/releases/tag/35.8.3