---
id: "CVE-2026-49442"
kind: "vulnerability"
aliases: ["CVE-2026-49442"]
title: "Cacti: login error message reveals which usernames exist"
severity: "medium"
cvss: 5.3
epss: 0.00405
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cacti", "monitoring", "package", "self-hosted"]
not_affected_if: ["login-not-reachable", "version-1.2.31-or-later"]
published_at: "2026-10-23T15:17:32+00:00"
first_seen_at: "2026-10-23T21:57:34+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49442", "first_seen_at": "2026-10-23T21:57:34+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-49442", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# Cacti: login error message reveals which usernames exist

Cacti's login page returns a slightly different error for existing and non-existing usernames, differing only in the capitalization of "failed". An attacker can use this to confirm valid usernames before attempting password guesses.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Cacti version, for example by reading the version shown in the Cacti web UI footer or `include/global.php` in the install directory.
- Confirm whether the Cacti login page is reachable from untrusted networks.

## Fix

- Upgrade Cacti to `1.2.31` or later.

## Timeline

- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-49442
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-49442

## From the sources

Cacti is an open source performance and fault management framework. Prior to version 1.2.31, a User Enumeration vulnerability allows an attacker to identify valid usernames on the Cacti service. When a user attempts to log in, the application returns slightly different error messages depending on whether the provided username exists in the system. When username exists on Cacti, in the response, they see Access Denied! Login failed. When it does not exist on Cacti, they see Access Denied! Login Failed. The only difference between the responses is the capitalization of the letter "f" in the word failed. This issue has been patched in version 1.2.31.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_