CVE-2026-49442: Cacti: User Enumeration via Error Messages
Cacti is an open source performance and fault management framework. Prior to version 1.2.31, a User Enumeration vulnerability allows an attacker to identify valid usernames on the Cacti service. When a user attempts to log in, the application returns slightly different error messages depending on whether the provided username exists in the system. When username exists on Cacti, in the response, they see Access Denied! Login failed. When it does not exist on Cacti, they see Access Denied! Login Failed. The only difference between the responses is the capitalization of the letter "f" in the word failed. This issue has been patched in version 1.2.31.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cactito a version that resolves this vulnerability.Fixed in 1.2.31
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote user who can reach the Cacti login interface can compare login error responses to determine whether submitted usernames exist.
What information can an attacker obtain?
The issue discloses whether a username is valid. It does not provide authentication bypass, data modification, or service disruption based on the supplied information.
Which systems are affected and what is the fix?
Cacti versions prior to 1.2.31 are affected. Upgrade to version 1.2.31, which patches the differing login error messages.
How can I verify whether an instance is vulnerable?
Submit login attempts using a known existing username and a nonexistent username, then compare the responses. Affected instances return "Access Denied! Login failed." for an existing username and "Access Denied! Login Failed." for a nonexistent one.