Detail
Username enumeration is a type of vulnerability in web applications, where it is possible to find exact usernames or to confirm that a guessed (or leaked) username exists in the system based on system response.
The API users endpoint no longer requires authentication to fetch data on individual users. This allows fetching of user data on instances that do not allow public projects. Privately hosted instances (and dev) shouldn't allow unauthenticated requests to this endpoint.
Solution Advice
- You have to update to the latest version.
- Access restriction should be applied.
Get AI-powered remediation steps tailored to your asset.
Try AI Solutions →