{"id":"CVE-2026-49442","kind":"vulnerability","aliases":["CVE-2026-49442"],"related":[],"title":"Cacti: login error message reveals which usernames exist","description":"Cacti is an open source performance and fault management framework. Prior to version 1.2.31, a User Enumeration vulnerability allows an attacker to identify valid usernames on the Cacti service. When a user attempts to log in, the application returns slightly different error messages depending on whether the provided username exists in the system. When username exists on Cacti, in the response, they see Access Denied! Login failed. When it does not exist on Cacti, they see Access Denied! Login Failed. The only difference between the responses is the capitalization of the letter \"f\" in the word failed. This issue has been patched in version 1.2.31.","summary":"Cacti's login page returns a slightly different error for existing and non-existing usernames, differing only in the capitalization of \"failed\". An attacker can use this to confirm valid usernames before attempting password guesses.","severity":"medium","cvss":5.3,"epss":0.00405,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cacti","monitoring","package","self-hosted"],"not_affected_if":["login-not-reachable","version-1.2.31-or-later"],"how_to_check":"- Check the installed Cacti version, for example by reading the version shown in the Cacti web UI footer or `include/global.php` in the install directory.\n- Confirm whether the Cacti login page is reachable from untrusted networks.","fix":"- Upgrade Cacti to `1.2.31` or later.","status":"open","published_at":"2026-10-23T15:17:32+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T04:18:52+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T04:18:52Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Cacti to `1.2.31` or later.","reach":"internet","title":"Cacti: login error message reveals which usernames exist","impact":"low","summary":"Cacti's login page returns a slightly different error for existing and non-existing usernames, differing only in the capitalization of \"failed\". An attacker can use this to confirm valid usernames before attempting password guesses.","category":"package","nicknames":[],"who_cares":["cacti","self-hosted","monitoring"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker learns valid usernames to target with password guessing","analyst_note":"","how_to_check":"- Check the installed Cacti version, for example by reading the version shown in the Cacti web UI footer or `include/global.php` in the install directory.\n- Confirm whether the Cacti login page is reachable from untrusted networks.","needs_analyst":false,"not_affected_if":["version-1.2.31-or-later","login-not-reachable"],"who_is_affected":"Any Cacti installation running a version before `1.2.31` is exposed, if its login page can be reached by the attacker. Installations that are only reachable on a trusted internal network carry less risk. The sources do not describe any extra configuration needed to trigger it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000574,"input_tokens":3391,"output_tokens":470,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':10A,13A '-49442':11A,14A '1.2.31':70C,161C 'access':120C,133C 'allow':75C 'applic':94C 'attack':45B,77C 'attempt':54B,89C 'cacti':1A,15B,21B,57C,84C,114C,130C 'capit':41B,145C 'confirm':50B 'cve':9A,12A 'deni':121C,134C 'depend':100C 'differ':28B,37B,97C,139C 'enumer':73C 'error':3A,29B,98C 'exist':8A,31B,35B,106C,112C,128C 'f':149C 'fail':43B,123C,136C,153C 'fault':64C 'framework':66C 'guess':56B 'host':20B 'identifi':79C 'issu':155C 'letter':148C 'log':91C 'login':2A,23B,122C,135C 'manag':65C 'messag':4A,99C 'monitor':16B 'non':34B 'non-exist':33B 'open':60C 'packag':17B 'page':24B 'password':55B 'patch':158C 'perform':62C 'prior':67C 'provid':104C 'respons':117C,142C 'return':25B,95C 'reveal':5A 'see':119C,132C 'self':19B 'self-host':18B 'servic':85C 'slight':27B,96C 'sourc':61C 'system':109C 'use':47B 'user':72C,88C 'usernam':7A,36B,52B,81C,105C,111C 'valid':51B,80C 'version':69C,160C 'vulner':74C 'whether':102C 'word':152C","nicknames":[],"mitigations":[],"who_affected":"Any Cacti installation running a version before `1.2.31` is exposed, if its login page can be reached by the attacker. Installations that are only reachable on a trusted internal network carry less risk. The sources do not describe any extra configuration needed to trigger it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T15:17:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-49442","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49442","severity":null,"published_at":"2026-10-23T15:17:32+00:00","modified_at":"2026-10-23T19:36:32+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-49442","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-49442","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}