CVE-2026-9161
Observable response discrepancy vulnerability in DernekPlus Website Template allows Account Footprinting. This issue affects Website Templa
CVSS
5.3
Medium
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Sep 10, 2026 · Last modified: Sep 10, 2026 · CWE-204
Not enough EPSS history yet.
Observable response discrepancy vulnerability in DernekPlus Website Template allows Account Footprinting. This issue affects Website Template: through 10092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-867586.5 MED—
——0Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and API index endpoints, allowing authenticated users with only licenses.view permission to access product keys. Attackers can download all license keys in bulk via CSV export or validate candidate keys through API response discrepancies without needing the viewKeys permission.2dCVE-2026-192057.5 HIG15.7%
——5Observable response discrepancy vulnerability in GastroMenum GastroMenum Web Panel allows Account Footprinting.
This issue affects GastroMenum Web Panel: before 31.08.2026.3dCVE-2026-190807.5 HIG22.7%
——7Observable response discrepancy vulnerability in Menulux Software Inc. Menulux Portal allows Account Footprinting.
This issue affects Menulux Portal: before 20260903211448.3dCVE-2026-785844.3 MED12.4%
——4Observable Response Discrepancy (CWE-204) in the Kibana Osquery feature can lead to information disclosure via Query System for Information (CAPEC-54). An authenticated user holding Osquery live-query privileges could determine whether a scheduled query identifier exists in a Kibana space they are not authorized to access.8dCVE-2026-843073.7 LOW21.7%
——7Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.5 and 5.7.5, packages/panels/src/Auth/Pages/Login.php presents the multi-factor authentication challenge before evaluating canAccessPanel(). For an account that canAccessPanel() denies, submitting the correct password renders the MFA challenge while an incorrect password returns the generic authentication failure, allowing an unauthenticated attacker to confirm whether a candidate password is valid for that account. When email-based MFA is configured, the correct-password path also sends a login code to the account holder. The issue applies only to accounts that have MFA enabled and are denied panel access. Authentication is not bypassed because canAccessPanel() still runs after the challenge, and no session is created. This issue is fixed in versions 4.12.5 and 5.7.5.9dCVE-2026-810335.3 MED20.8%
——6Automatisch reveals whether an address is registered through the response to its forgot-password request. The controller at packages/backend/src/controllers/internal/api/v1/users/forgot-password.js looks the address up and chains a not-found throw onto the query, so an address with no account raises an error that the global handler renders as a not-found status, while a registered address proceeds to send the reset message and returns no-content. The route is mounted without authentication. Submitting candidate addresses and comparing the two status codes therefore establishes which addresses hold accounts, with no credential and no rate limiting in the path.13d