CVE-2026-32702 - Vulnerability Analysis

Overview

Cleanuparr 2.7.0 to 2.8.0 contains a username enumeration vulnerability caused by a timing side-channel in the /api/auth/login endpoint, letting unauthenticated remote attackers enumerate valid usernames by measuring response time, exploit requires network access to the login endpoint.

Severity & Score

Impact

Unauthenticated attackers can enumerate valid usernames, aiding further targeted attacks or credential guessing.

Mitigation

Upgrade to version 2.8.1 or later.

References

• https://github.com/Cleanuparr/Cleanuparr/security/advisories/GHSA-gjmf-m27r-2c9v

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner