OMERO.web displays unecessary user information when requesting to reset the password

OMERO.web, a Django-based web client for the OMERO platform, provides a "Forgot Password" feature to allow users to reset their passwords. Prior to version 5.29.2, when an error occurred during password reset (for example, if the provided email or username did not match any user), the error message displayed on the webpage could disclose whether the user identity was valid. Specifically, the application would return a detailed error message from the server rather than a generic message, revealing the existence or non-existence of the account [1][3].

The vulnerability is triggered without authentication, as the "Forgot Password" form is accessible to any visitor. No special privileges or user interaction beyond submitting the form are required. The root cause lies in the error handling logic: the server returned the raw error message from the backend (omero.CmdError) which included user-specific information, instead of returning a uniform message in all cases [4].

An attacker could exploit this by submitting various emails or usernames to the password reset endpoint and observing the error messages. If the message differs between an existing and non-existing user, the attacker can enumerate valid user accounts. This information disclosure can then be chained with other attacks, such as brute-force or targeted phishing, increasing the risk to user privacy and account security [1][3].

The issue has been patched in OMERO.web version 5.29.2. The fix ensures that regardless of the error outcome, the same generic message—"Password was reset. Check your mailbox."—is returned, preventing any information leakage [4]. For those unable to upgrade immediately, a workaround is available: disabling the "Forgot Password" option entirely by setting the configuration property omero.web.show_forgot_password to false [1].