Medium severity5.3NVD Advisory· Published Dec 2, 2025· Updated Jun 17, 2026
CVE-2025-41066
CVE-2025-41066
Description
Horde Groupware v5.2.22 has a user enumeration vulnerability that allows an unauthenticated attacker to determine the existence of valid accounts on the system. To exploit the vulnerability, an HTTP request must be sent to ‘/imp/attachment.php’ including the parameters ‘id’ and ‘u’. If the specified user exists, the server will return the download of an empty file; if it does not exist, no download will be initiated, which unequivocally reveals the validity of the user.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3cpe:2.3:a:horde:groupware:5.2.22:*:*:*:-:*:*:*+ 2 more
- cpe:2.3:a:horde:groupware:5.2.22:*:*:*:-:*:*:*
- (no CPE)range: <=5.2.22
- (no CPE)range: 5.2.22
Patches
Vulnerability mechanics
References
1- www.incibe.es/en/incibe-cert/notices/aviso/disclosure-sensitive-information-horde-groupwarenvdThird Party Advisory
News mentions
0No linked articles in our index yet.