Vulnerability · Published Oct 23, 2026 · Assigned by GitHub_M
CVE-2026-49442Cacti: User Enumeration via Error Messages
Medium 5.3
In plain English
A medium-severity security flaw in cacti from Cacti. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Cacti is an open source performance and fault management framework. Prior to version 1.2.31, a User Enumeration vulnerability allows an attacker to identify valid usernames on the Cacti service. When a user attempts to log in, the application returns slightly different error messages depending on whether the provided username exists in the system. When username exists on Cacti, in the response, they see Access Denied! Login failed. When it does not exist on Cacti, they see Access Denied! Login Failed. The only difference between the responses is the capitalization of the letter "f" in the word failed. This issue has been patched in version 1.2.31.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | cacti | no fix listed | DEBIAN-CVE-2026-49442 |
| Debian:13 | cacti | no fix listed | DEBIAN-CVE-2026-49442 |
| Debian:14 | cacti | 1.2.31+ds1-1 | DEBIAN-CVE-2026-49442 |
| Ubuntu:24.04:LTS | cacti | no fix listed | UBUNTU-CVE-2026-49442 |
| Ubuntu:26.04:LTS | cacti | no fix listed | UBUNTU-CVE-2026-49442 |
| Ubuntu:26.10 | cacti | no fix listed | UBUNTU-CVE-2026-49442 |
Affected products (as reported)
Weakness: CWE-204 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- https://github.com/Cacti/cacti/security/advisories/GHSA-m7v2-f3xw-3qh7 x_refsource_CONFIRM
- https://github.com/Cacti/cacti/pull/7166 x_refsource_MISC
- https://github.com/Cacti/cacti/commit/ab4baf338d65dcaafe1bd97d1e2a310fe0af0e3e x_refsource_MISC